CN-Invoice-XXXXX9808-19011143287994.exe
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
malicious
|
||
|
malicious
Score: 100
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
|
| IP | Country | Detection |
|---|---|---|
| 172.67.172.17 | United States |  |
| 157.97.120.21 | Netherlands |  |
| 185.157.161.86 | Sweden | |
| Name | IP | Detection |
|---|---|---|
| coroloboxorozor.com | 172.67.172.17 | |
| nanopc.linkpc.net | 157.97.120.21 | |
| Name | Detection |
|---|---|
| http://coroloboxorozor.com/base/7A885C86AF3E7CAEF5D9FC154830C30E.html | |
| http://coroloboxorozor.com/base/88756E9935B1A5EAEE811D9BDFD69574.html | |
| http://coroloboxorozor.com/base/F5B9A7CB87ADE6C09DC3687F02604706.html | |
| Click to see the 30 hidden entries | |
| http://coroloboxorozor.com | |
| https://sectigo.com/CPS0C | |
| http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid | |
| https://go.microd: | |
| http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o | |
| http://schemas.xmlsoap.org/wsdl/ | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/ | |
| https://sectigo.com/CPS0D | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/ | |
| http://www.nirsoft.net/ | |
| http://crl.micr | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005 | |
| https://github.com/Pester/Pester | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20 | |
| http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0# | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince | |
| http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone | |
| http://www.apache.org/licenses/LICENSE-2.0.html | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200 | |
| http://schemas.xmlsoap.org/soap/encoding/ | |
| http://pesterbdd.com/images/Pester.png | |
| http://ocsp.sectigo.com0 | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Windows\Microsoft.NET\Framework\xrpSendfsxM\svchost.exe:Zone.Identifier |
ASCII text, with CRLF line terminators | # | |
C:\Windows\Microsoft.NET\Framework\xrpSendfsxM\svchost.exe |
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat |
data | # | |
| Click to see the 20 hidden entries | |||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fiaxfjc3.2me.psm1 |
very short file (no magic) | # | |
C:\Users\user\Documents\20210225\PowerShell_transcript.367706.M_cQjc0Y.20210225151010.txt |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\Documents\20210225\PowerShell_transcript.367706.KMuPlgZO.20210225151021.txt |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\e33cd0bd-fe57-408e-abef-c8ddfa8d2134\test.bat |
ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\e33cd0bd-fe57-408e-abef-c8ddfa8d2134\AdvancedRun.exe |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\ad6ba6ad-9e3d-4fc8-98d0-88a6e198c3b3\test.bat |
ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\ad6ba6ad-9e3d-4fc8-98d0-88a6e198c3b3\AdvancedRun.exe |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xaqb5cyd.oyj.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ginmqqci.bv3.ps1 |
very short file (no magic) | # | |
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_DICYYIQK30AZ1ATY_61d1cfef5cda9156e8bf5d3a5ef80772aa5bd7d_4c8b36b8_1802e6ce\Report.wer |
Little-endian UTF-16 Unicode text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhngzly1.1a0.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\5013165c-d39a-4f57-8b45-9c3615d2afd1\test.bat |
ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\5013165c-d39a-4f57-8b45-9c3615d2afd1\AdvancedRun.exe |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache |
data | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WERACC4.tmp.txt |
data | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6E7.tmp.csv |
data | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA68B.tmp.xml |
XML 1.0 document, ASCII text, with CRLF line terminators | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E2E.tmp.WERInternalMetadata.xml |
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D4B.tmp.dmp |
Mini DuMP crash report, 15 streams, Thu Feb 25 14:10:52 2021, 0x1205a4 type | # | |
