File name:

unchecky_setup.exe

Full analysis: https://app.any.run/tasks/c5c4825f-d37b-4ca9-99e0-3d21b63a607e
Verdict: Malicious activity
Analysis date: April 24, 2021, 23:52:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
unchecky
antirogue
tools
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

51E748220686D15E0275CA9984D5972E

SHA1:

7B3FCF37990E1C0500DC55A0EDBDBBEA2D916EBA

SHA256:

25896931DB48F0F4C9E3681720FB7C89B531D912CE5F11D596078F8D917126B7

SSDEEP:

24576:3Y/wefjMWyNRFrffWegjppY/B3GpltIt4owuPId5Dmx2wdy:+wefjMWc1WeCpY/B22tA3s2wdy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • unchecky_setup.exe (PID: 3804)

    • Writes to the hosts file

      • unchecky_svc.exe (PID: 2680)

    • Application was dropped or rewritten from another process

      • unchecky_bg.exe (PID: 584)
      • unchecky_svc.exe (PID: 2680)
      • unchecky.exe (PID: 1536)
      • unchecky.exe (PID: 3608)

    • Loads dropped or rewritten executable

      • unchecky_setup.exe (PID: 396)

  • SUSPICIOUS

    • Application launched itself

      • unchecky_setup.exe (PID: 396)

    • Creates a directory in Program Files

      • unchecky_setup.exe (PID: 3804)

    • Adds / modifies Windows certificates

      • unchecky_setup.exe (PID: 3804)

    • Executable content was dropped or overwritten

      • unchecky_setup.exe (PID: 3804)

    • Creates files in the program directory

      • unchecky_setup.exe (PID: 3804)
      • unchecky_svc.exe (PID: 2680)

    • Creates a software uninstall entry

      • unchecky_setup.exe (PID: 3804)

    • Executed as Windows Service

      • unchecky_svc.exe (PID: 2680)

  • INFO

    • Reads the hosts file

      • unchecky_svc.exe (PID: 2680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:03:25 16:38:23+02:00
PEType: PE32
LinkerVersion: 14.13
CodeSize: 225280
InitializedDataSize: 32768
UninitializedDataSize: 319488
EntryPoint: 0x85490
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.0
ProductVersionNumber: 1.2.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Reason Software Company Inc.
FileDescription: Unchecky Setup
FileVersion: 1.2
LegalCopyright: Copyright Reason Software Company Inc.
ProductName: Unchecky
ProductVersion: 1.2

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Mar-2018 14:38:23
Detected languages:
  • Bulgarian - Bulgaria
  • Catalan - Spain
  • Chinese - Taiwan
  • Croatian - Croatia
  • Czech - Czech Republic
  • Danish - Denmark
  • Dutch - Netherlands
  • English - United States
  • Estonian - Estonia
  • Finnish - Finland
  • French - France
  • German - Germany
  • Greek - Greece
  • Hebrew - Israel
  • Hungarian - Hungary
  • Indonesian - Indonesia (Bahasa)
  • Italian - Italy
  • Japanese - Japan
  • Korean - Korea
  • Lithuanian - Lithuania
  • Norwegian - Norway (Bokmal)
  • Polish - Poland
  • Portuguese - Brazil
  • Portuguese - Portugal
  • Russian - Russia
  • Spanish - Mexico
  • Swedish - Sweden
  • Turkish - Turkey
  • Ukrainian - Ukraine
  • Vietnamese - Viet Nam
CompanyName: Reason Software Company Inc.
FileDescription: Unchecky Setup
FileVersion: 1.2
LegalCopyright: Copyright Reason Software Company Inc.
ProductName: Unchecky
ProductVersion: 1.2

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 25-Mar-2018 14:38:23
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x0004E000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x0004F000
0x00037000
0x00036800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.92125
.rsrc
0x00086000
0x00008000
0x00007C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.79459

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.17402
1974
UNKNOWN
English - United States
RT_MANIFEST
2
5.42186
1384
UNKNOWN
UNKNOWN
RT_ICON
3
3.74963
744
UNKNOWN
UNKNOWN
RT_ICON
4
6.16608
2216
UNKNOWN
UNKNOWN
RT_ICON
5
3.91942
1640
UNKNOWN
UNKNOWN
RT_ICON
6
4.84061
3752
UNKNOWN
UNKNOWN
RT_ICON
7
5.58096
1128
UNKNOWN
UNKNOWN
RT_ICON
8
5.61959
4264
UNKNOWN
UNKNOWN
RT_ICON
9
5.39338
9640
UNKNOWN
UNKNOWN
RT_ICON
10
7.91405
37385
UNKNOWN
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.DLL
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start unchecky_setup.exe no specs unchecky_setup.exe unchecky_svc.exe no specs unchecky_bg.exe no specs unchecky.exe no specs unchecky.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396"C:\Users\admin\Downloads\unchecky_setup.exe" C:\Users\admin\Downloads\unchecky_setup.exe—explorer.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
MEDIUM
Description:
Unchecky Setup
Exit code:
0
Version:
1.2
Modules
Images
c:\users\admin\downloads\unchecky_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
584"C:\Program Files\Unchecky\bin\unchecky_bg.exe" -startC:\Program Files\Unchecky\bin\unchecky_bg.exe—unchecky_svc.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
MEDIUM
Description:
Unchecky Background Process
Exit code:
0
Version:
1.2
Modules
Images
c:\program files\unchecky\bin\unchecky_bg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1536"C:\Program Files\Unchecky\unchecky.exe"C:\Program Files\Unchecky\unchecky.exe—unchecky_bg.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
MEDIUM
Description:
Unchecky
Exit code:
0
Version:
1.2
Modules
Images
c:\program files\unchecky\unchecky.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2680"C:\Program Files\Unchecky\bin\unchecky_svc.exe"C:\Program Files\Unchecky\bin\unchecky_svc.exe—services.exe
User:
SYSTEM
Company:
Reason Software Company Inc.
Integrity Level:
SYSTEM
Description:
Unchecky Service
Exit code:
0
Version:
1.2
Modules
Images
c:\program files\unchecky\bin\unchecky_svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winhttp.dll
3608"C:\Program Files\Unchecky\unchecky.exe"C:\Program Files\Unchecky\unchecky.exe—unchecky_bg.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
MEDIUM
Description:
Unchecky
Exit code:
0
Version:
1.2
Modules
Images
c:\program files\unchecky\unchecky.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3804"C:\Users\admin\Downloads\unchecky_setup.exe" -install -path "C:\Program Files\Unchecky" -lang 1033C:\Users\admin\Downloads\unchecky_setup.exe
unchecky_setup.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
Unchecky Setup
Exit code:
0
Version:
1.2
Modules
Images
c:\users\admin\downloads\unchecky_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
559
Read events
529
Write events
30
Delete events
0

Modification events

(PID) Process:(396) unchecky_setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(396) unchecky_setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16
Operation:writeName:Blob
Value:
04000000010000001000000043C6BFAEECFEAD2F18C6886830FCC8E60F00000001000000200000006FC4B8AC3D2B52C08BAF56255E43D22C762962E4FACAB01ACE16D48EC008BE0A0300000001000000140000008DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE161D000000010000001000000099C508FD54CBC396CC3256BB87829AE01400000001000000140000008418CC8534ECBC0C94942E08599CC7B2104E0A0853000000010000001F000000301D301B060567810C010130123010060A2B0601040182373C0101030200C06200000001000000200000008ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E0B000000010000002200000041006D0061007A006F006E00200052006F006F007400200043004100200031000000090000000100000042000000304006082B0601050507030106082B0601050507030206082B0601050507030406082B06010505070308060A2B0601040182370A0304060A2B0601040182370A030C19000000010000001000000094BA2A8E68434595D5AFF46246C54C122000000001000000450300003082034130820229A0030201020213066C9FCF99BF8C0A39E2F0788A43E696365BCA300D06092A864886F70D01010B05003039310B3009060355040613025553310F300D060355040A1306416D617A6F6E3119301706035504031310416D617A6F6E20526F6F742043412031301E170D3135303532363030303030305A170D3338303131373030303030305A3039310B3009060355040613025553310F300D060355040A1306416D617A6F6E3119301706035504031310416D617A6F6E20526F6F74204341203130820122300D06092A864886F70D01010105000382010F003082010A0282010100B2788071CA78D5E371AF478050747D6ED8D78876F49968F7582160F97484012FAC022D86D3A0437A4EB2A4D036BA01BE8DDB48C80717364CF4EE8823C73EEB37F5B519F84968B0DED7B976381D619EA4FE8236A5E54A56E445E1F9FDB416FA74DA9C9B35392FFAB02050066C7AD080B2A6F9AFEC47198F503807DCA2873958F8BAD5A9F948673096EE94785E6F89A351C0308666A14566BA54EBA3C391F948DCFFD1E8302D7D2D747035D78824F79EC4596EBB738717F2324628B843FAB71DAACAB4F29F240E2D4BF7715C5E69FFEA9502CB388AAE50386FDBFB2D621BC5C71E54E177E067C80F9C8723D63F40207F2080C4804C3E3B24268E04AE6C9AC8AA0D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186301D0603551D0E041604148418CC8534ECBC0C94942E08599CC7B2104E0A08300D06092A864886F70D01010B0500038201010098F2375A4190A11AC57651282036230EAEE628BBAAF894AE48A4307F1BFC248D4BB4C8A197F6B6F17A70C85393CC0828E39825CF23A4F9DE21D37C8509AD4E9A753AC20B6A897876444718656C8D418E3B7F9ACBF4B5A750D7052C37E8034BADE961A0026EF5F2F0C5B2ED5BB7DCFA945C779E13A57F52AD95F2F8933BDE8B5C5BCA5A525B60AF14F74BEFA3FB9F40956D3154FC42D3C7461F23ADD90F48709AD9757871D1724334756E5759C2025C266029CF2319168E8843A5D4E4CB08FB231143E843297262A1A95D5E08D490AEB8D8CE14C2D055F286F6C49343776661C0B9E841D7977860036E4A72AEA5D17DBA109E866C1B8AB95933F8EBC490BEF1B9
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F
Operation:writeName:Blob
Value:
040000000100000010000000173574AF7B611CEBF4F93CE2EE40F9A20F00000001000000200000001504593902EC8A0BAB29F03BF35C3058B5FD1807A74DAB92CB61ED4A9908AFA4030000000100000014000000925A8F8D2C6D04E0665F596AFF22D863E8256F3F1D000000010000001000000052135310639A10F77F886B229B9F7AFC1400000001000000140000009C5F00DFAA01D7302B3888A2B86D4A9CF2119183620000000100000020000000568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB553000000010000002500000030233021060B6086480186FD6E0107180330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B000000010000006200000041006D0061007A006F006E00200053006500720076006900630065007300200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F00720069007400790020002D002D00200047003200000019000000010000001000000014D4B19434670E6DC091D154ABB20EDC2000000001000000F3030000308203EF308202D7A003020102020100300D06092A864886F70D01010B0500308198310B30090603550406130255533110300E060355040813074172697A6F6E61311330110603550407130A53636F74747364616C6531253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E313B303906035504031332537461726669656C6420536572766963657320526F6F7420436572746966696361746520417574686F72697479202D204732301E170D3039303930313030303030305A170D3337313233313233353935395A308198310B30090603550406130255533110300E060355040813074172697A6F6E61311330110603550407130A53636F74747364616C6531253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E313B303906035504031332537461726669656C6420536572766963657320526F6F7420436572746966696361746520417574686F72697479202D20473230820122300D06092A864886F70D01010105000382010F003082010A0282010100D50C3AC42AF94EE2F5BE19975F8E8853B11F3FCBCF9F20136D293AC80F7D3CF76B763863D93660A89B5E5C0080B22F597FF687F9254386E7691B529A90E171E3D82D0D4E6FF6C849D9B6F31A56AE2BB67414EBCFFB26E31ABA1D962E6A3B5894894756FF25A093705383DA847414C3679E04683ADF8E405A1D4A4ECF43913BE756D60070CB52EE7B7DAE3AE7BC31F945F6C260CF1359022B80CC3447DFB9DE90656D02CF2C91A6A6E7DE8518497C664EA33A6DA9B5EE342EBA0D03B833DF47EBB16B8D25D99BCE81D1454632967087DE020E494385B66C73BB64EA6141ACC9D454DF872FC722B226CC9F5954689FFCBE2A2FC4551C75406017850255398B7F050203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604149C5F00DFAA01D7302B3888A2B86D4A9CF2119183300D06092A864886F70D01010B050003820101004B36A6847769DD3B199F6723086F0E61C9FD84DC5FD83681CDD81B412D9F60DDC71A68D9D16E86E18823CF13DE43CFE234B3049D1F29D5BFF85EC8D5C1BDEE926F3274F291822FBD82427AAD2AB7207D4DBC7A5512C215EABDF76A952E6C749FCF1CB4F2C501A385D0723EAD73AB0B9B750C6D45B78E94AC9637B5A0D08F15470EE3E883DD8FFDEF410177CC27A9628533F23708EF71CF7706DEC8191D8840CF7D461DFF1EC7E1CEFF23DBC6FA8D554EA902E74711463EF4FDBD7B2926BBA961623728B62D2AF6108664C970A7D2ADB7297079EA3CDA63259FFD68B730EC70FB758AB76D6067B21EC8B9E9D8A86F028B670D4D265771DA20FCC14A508DB128BA
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A
Operation:writeName:Blob
Value:
040000000100000010000000324A4BBBC863699BBE749AC6DD1D46240F00000001000000140000000F6AAD4C3FE04619CDC8B2BD655AA1A26042E650030000000100000014000000AD7E1C28B064EF8F6003402014C3D0E3370EB58A1D000000010000001000000090C4F4233B006B7BFAA6ADCD8F577D77140000000100000014000000BF5FB7D1CEDD1F86F45B55ACDCD710C20EA988E76200000001000000200000001465FA205397B876FAA6F0A9958E5590E40FCC7FAA4FB7C2C8677521FB5FB65809000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000004800000030463021060B6086480186FD6D0107170330123010060A2B0601040182373C0101030200C03021060B6086480186FD6E0107170330123010060A2B0601040182373C0101030200C00B000000010000005400000053007400610072006600690065006C006400200043006C00610073007300200032002000430065007200740069006600690063006100740069006F006E00200041007500740068006F0072006900740079000000190000000100000010000000FD960962AC6938E0D4B0769AA1A64E262000000001000000130400003082040F308202F7A003020102020100300D06092A864886F70D01010505003068310B300906035504061302555331253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E31323030060355040B1329537461726669656C6420436C61737320322043657274696669636174696F6E20417574686F72697479301E170D3034303632393137333931365A170D3334303632393137333931365A3068310B300906035504061302555331253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E31323030060355040B1329537461726669656C6420436C61737320322043657274696669636174696F6E20417574686F7269747930820120300D06092A864886F70D01010105000382010D00308201080282010100B732C8FEE971A60485AD0C1164DFCE4DEFC80318873FA1ABFB3CA69FF0C3A1DAD4D86E2B5390FB24A43E84F09EE85FECE52744F528A63F7BDEE02AF0C8AF532F9ECA0501931E8F661C39A74DFA5AB673042566EB777FE759C64A99251454EB26C7F37F19D530708FAFB0462AFFADEB29EDD79FAA0487A3D4F989A5345FDB43918236D9663CB1B8B982FD9C3A3E10C83BEF0665667A9B19183DFF71513C302E5FBE3D7773B25D066CC323569A2B8526921CA702B3E43F0DAF087982B8363DEA9CD335B3BC69CAF5CC9DE8FD648D1780336E5E4A5D99C91E87B49D1AC0D56E1335235EDF9B5F3DEFD6F776C2EA3EBB780D1C42676B04D8F8D6DA6F8BF244A001AB020103A381C53081C2301D0603551D0E04160414BF5FB7D1CEDD1F86F45B55ACDCD710C20EA988E73081920603551D2304818A3081878014BF5FB7D1CEDD1F86F45B55ACDCD710C20EA988E7A16CA46A3068310B300906035504061302555331253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E31323030060355040B1329537461726669656C6420436C61737320322043657274696669636174696F6E20417574686F72697479820100300C0603551D13040530030101FF300D06092A864886F70D01010505000382010100059D3F889DD1C91A55A1AC69F3F359DA9B01871A4F57A9A179092ADBF72FB21ECCC75E6AD88387A197EF49353E7706415862BF8E58B80A673FECB3DD21661FC954FA72CC3D4C40D881AF779E837ABBA2C7F534178ED91140F4FC2C2A4D157FA7625D2E25D3000B201A1D68F917B8F4BD8BED2859DD4D168B1783C8B265C72D7AA5AABC53866DDD57A4CAF820410B68F0F4FB74BE565D7A79F5F91D85E32D95BEF5719043CC8D1F9A000A8729E95522580023EAE31243295B4708DD8C416A6506A8E521AA41B4952195B97DD134AB13D6ADBCDCE23D39CDBD3E7570A1185903C922B48F9CD55E2AD7A5B6D40A6DF8B74011469A1F790E62BF0F97ECE02F1F1794
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_CURRENT_USER\Software\Unchecky
Operation:writeName:Language
Value:
1033
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Unchecky
Operation:writeName:Language
Value:
1033
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Unchecky
Operation:writeName:Path
Value:
C:\Program Files\Unchecky
(PID) Process:(3804) unchecky_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Unchecky
Operation:writeName:InstTime
Value:
7D5A1BF76439D701
Executable files
6
Suspicious files
1
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
3804unchecky_setup.exeC:\Program Files\Unchecky\bin\unchecky_bg.exeexecutable
MD5:3E0CD49A17BD475CA9BE3CB6A1526D40
SHA256:9E1FAAD95C7CE3C42503958A93265E08FB7FCEB7EE35FEE11D7A0FF6F1EC4E8C
3804unchecky_setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unchecky\Uninstall.lnklnk
MD5:—
SHA256:—
3804unchecky_setup.exeC:\Program Files\Unchecky\uninstall.exeexecutable
MD5:7215DEEE3AB853EE5B6B91147B0207FC
SHA256:911A47E0781C7C82F5F743211C95FF7C54E619694A64ADE4B8F534636E27341E
3804unchecky_setup.exeC:\Users\Public\Desktop\Unchecky.lnklnk
MD5:—
SHA256:—
3804unchecky_setup.exeC:\ProgramData\Unchecky\uclogfile.bintext
MD5:—
SHA256:—
396unchecky_setup.exeC:\ProgramData\Unchecky\uclogfile.bintext
MD5:—
SHA256:—
3804unchecky_setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unchecky\Unchecky.lnklnk
MD5:—
SHA256:—
2680unchecky_svc.exeC:\ProgramData\Unchecky\hosts_backuptext
MD5:3688374325B992DEF12793500307566D
SHA256:2D6BDFB341BE3A6234B24742377F93AA7C7CFB0D9FD64EFA9282C87852E57085
3804unchecky_setup.exeC:\Program Files\Unchecky\bin\unchecky_svc.exeexecutable
MD5:1671436888E5C3477697B56659033AE2
SHA256:45ADA13291138074FEC19C74C4605E7F90361037506C3BF0132ADCA80D2854CA
3804unchecky_setup.exeC:\Program Files\Unchecky\bin\inject.dllexecutable
MD5:F4BC767CE64CBE43236887AABFE9EAB8
SHA256:A7C5E407B93C06450147E57F34AD8C70F67DA34CC6EFEA32C07582C6E22A4EED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3804
unchecky_setup.exe
35.168.80.83:443
logs.unchecky.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
logs.unchecky.com
  • 35.168.80.83
  • 34.196.39.63
  • 54.84.220.80
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
unchecky_setup.exe