File name:

TCPOptimizer.exe

Full analysis: https://app.any.run/tasks/fc3e23a3-6ae1-4c14-a789-65fe34c8b082
Verdict: Malicious activity
Analysis date: December 06, 2023, 11:18:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D8292150C8CE862A97A923318DF07805

SHA1:

917F917FF9FE33E199388E5E1D4C0696882D2991

SHA256:

0A49DC0D2CE725AF347DF632539B70AFCFD22B38E285920B515143332A5511E9

SSDEEP:

12288:C1B8g1arhMAURdndzQTEEI7b6Yz3m5W6:pujRdndzQfqb3K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Suspicious use of NETSH.EXE

      • TCPOptimizer.exe (PID: 3048)
      • TCPOptimizer.exe (PID: 3296)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1440)
      • ctfmon.exe (PID: 1484)
      • ctfmon.exe (PID: 1468)
      • sipnotify.exe (PID: 1504)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1440)
      • sipnotify.exe (PID: 1504)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1440)
      • sipnotify.exe (PID: 1504)

  • INFO

    • Reads the machine GUID from the registry

      • TCPOptimizer.exe (PID: 3048)
      • TCPOptimizer.exe (PID: 3296)

    • Checks supported languages

      • TCPOptimizer.exe (PID: 3048)
      • TCPOptimizer.exe (PID: 3296)
      • wmpnscfg.exe (PID: 2296)
      • IMEKLMG.EXE (PID: 2064)
      • wmpnscfg.exe (PID: 2452)
      • wmpnscfg.exe (PID: 2340)
      • IMEKLMG.EXE (PID: 2056)
      • IMEKLMG.EXE (PID: 124)
      • IMEKLMG.EXE (PID: 1940)
      • wmpnscfg.exe (PID: 2236)
      • wmpnscfg.exe (PID: 2276)

    • Create files in a temporary directory

      • TCPOptimizer.exe (PID: 3048)
      • TCPOptimizer.exe (PID: 3296)

    • Reads product name

      • TCPOptimizer.exe (PID: 3048)
      • TCPOptimizer.exe (PID: 3296)

    • Reads Environment values

      • TCPOptimizer.exe (PID: 3048)
      • TCPOptimizer.exe (PID: 3296)

    • Manual execution by a user

      • TCPOptimizer.exe (PID: 3296)
      • IMEKLMG.EXE (PID: 2056)
      • IMEKLMG.EXE (PID: 2064)
      • wmpnscfg.exe (PID: 2340)
      • wmpnscfg.exe (PID: 2296)
      • IMEKLMG.EXE (PID: 124)
      • IMEKLMG.EXE (PID: 1940)
      • wmpnscfg.exe (PID: 2236)
      • wmpnscfg.exe (PID: 2276)
      • wmpnscfg.exe (PID: 2452)

    • Reads the computer name

      • TCPOptimizer.exe (PID: 3296)
      • TCPOptimizer.exe (PID: 3048)
      • IMEKLMG.EXE (PID: 2056)
      • IMEKLMG.EXE (PID: 2064)
      • wmpnscfg.exe (PID: 2296)
      • wmpnscfg.exe (PID: 2340)
      • wmpnscfg.exe (PID: 2452)
      • IMEKLMG.EXE (PID: 124)
      • wmpnscfg.exe (PID: 2276)
      • wmpnscfg.exe (PID: 2236)
      • IMEKLMG.EXE (PID: 1940)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1440)
      • sipnotify.exe (PID: 1504)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 2064)
      • IMEKLMG.EXE (PID: 2056)
      • IMEKLMG.EXE (PID: 124)
      • IMEKLMG.EXE (PID: 1940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (33)
.exe | Win32 Executable MS Visual C++ (generic) (23.9)
.exe | Win64 Executable (generic) (21.2)
.scr | Windows screen saver (10)
.dll | Win32 Dynamic Link Library (generic) (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:01:09 21:32:16+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 348160
InitializedDataSize: 720896
UninitializedDataSize: -
EntryPoint: 0x3205f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.1.1.0
ProductVersionNumber: 4.1.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Coded and (c) Speed Guide, Inc. - webmaster@speedguide.net / outsorcing@gmail.com
CompanyName: Speed Guide Inc.
FileDescription: SG TCP Optimizer
FileVersion: 4.1.1.0
InternalName: TCP Optimizer
LegalCopyright: Copyright (c) 2001-2021
LegalTrademarks: Speed Guide Inc
OriginalFileName: TCPOptimizer.exe
ProductName: SG TCP Optimizer Application
ProductVersion: 4.1.1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
32
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start tcpoptimizer.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs tcpoptimizer.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
880netsh int tcp show supplementalC:\Windows\System32\netsh.exe—TCPOptimizer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1440C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1468C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1484C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1496netsh int tcp set global netdma=disabledC:\Windows\System32\netsh.exe—TCPOptimizer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1504C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1940"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2056"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2064"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
Total events
15 216
Read events
14 421
Write events
795
Delete events
0

Modification events

(PID) Process:(2920) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2084) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2424) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3892) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(880) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2608) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3052) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3644) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3728) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3584) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
4
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3296TCPOptimizer.exeC:\Users\admin\Desktop\FirstBackup.spgtext
MD5:44A1912199EE76F3C8185781600D2094
SHA256:8FBF53CFC0E825A80F80595912E06AE34138C965F70B9FF0B7C138DC4C8A3B1D
3296TCPOptimizer.exeC:\Users\admin\AppData\Local\Temp\~DF65142F645AD5243D.TMPbinary
MD5:EFBFBC777BE8D2352C7BECB2EF8237BF
SHA256:853EF75C72B07264151F548E1AA35DAB8E961A0B4709FAF25ACFCD35304F5CDD
1504sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
1504sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\metadata.jsonbinary
MD5:E8A970BA6CE386EED9A5E724F26212A6
SHA256:7E06107D585D8FC7870998F3856DCC3E35800AA97E4406AAB83BC8444B6CBDE3
1440sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
3048TCPOptimizer.exeC:\Users\admin\AppData\Local\Temp\~DFCB90F0C36D8F2EC6.TMPbinary
MD5:AA2BDA10FEA27344639D890893CF7492
SHA256:FB40BC5BB059E364E6EDCE2045A6C259BB320CCE2E81330759828A7BF2955140
1504sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\main.jpgimage
MD5:B342ACE63F77961249A084C61EABC884
SHA256:E5067BBA2095B5DA7C3171EC116E9A92337E24E471339B0860A160076EFE49B9
1504sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\en-us.htmlhtml
MD5:9752942B57692148B9F614CF4C119A36
SHA256:E31B834DD53FA6815F396FC09C726636ABF98F3367F0CF1590EF5EB3801C75D1
1440sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\script.jstext
MD5:A2682382967C351F7ED21762F9E5DE9E
SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2
1504sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\script.jstext
MD5:A2682382967C351F7ED21762F9E5DE9E
SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
15
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1440
sipnotify.exe
HEAD
200
2.23.65.216:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133463353542500000
unknown
—
—
unknown
1440
sipnotify.exe
HEAD
200
2.23.65.216:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133463351941400000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1096
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1440
sipnotify.exe
2.23.65.216:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
2700
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1124
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 2.23.65.216
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TCPOptimizer.exe