File name:

Andy_47.260_1096_26_x64.exe

Full analysis: https://app.any.run/tasks/679f9eef-2deb-4abc-b005-5c6d199e44a5
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 02:33:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
pua
adware
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

00F93A78B4E447C8D80E588878B8D99E

SHA1:

AC1508D0DE07079ACC7A12FC45885456305766B2

SHA256:

270453AADA7A064E133890794E84270599723B3BFA0121104ABDAD1A79A13B7B

SSDEEP:

98304:wFlT8qeEpbDZ+JC2HzGXRbGlAwt6QgCqlJCN+GL0AG+G/s:eDhIc2KyRt6QgC/0AG6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • ADWARE has been detected (SURICATA)

      • Andy_47.260_1096_26_x64.exe (PID: 6776)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Andy_47.260_1096_26_x64.exe (PID: 6396)

    • The process drops C-runtime libraries

      • Andy_47.260_1096_26_x64.exe (PID: 6396)

    • Executable content was dropped or overwritten

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • The process creates files with name similar to system file names

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Checks Windows Trust Settings

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Reads security settings of Internet Explorer

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Application launched itself

      • Andy_47.260_1096_26_x64.exe (PID: 6396)

    • Adds/modifies Windows certificates

      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Access to an unwanted program domain was detected

      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Process requests binary or script from the Internet

      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Potential Corporate Privacy Violation

      • Andy_47.260_1096_26_x64.exe (PID: 6776)

  • INFO

    • Checks supported languages

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)
      • SearchApp.exe (PID: 5064)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5064)
      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Reads the computer name

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5064)
      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • The sample compiled with english language support

      • Andy_47.260_1096_26_x64.exe (PID: 6396)

    • Create files in a temporary directory

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Checks proxy server information

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Creates files or folders in the user directory

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • The process uses the downloaded file

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Process checks computer location settings

      • Andy_47.260_1096_26_x64.exe (PID: 6396)
      • SearchApp.exe (PID: 5064)

    • Disables trace logs

      • Andy_47.260_1096_26_x64.exe (PID: 6776)

    • Sends debugging messages

      • Andy_47.260_1096_26_x64.exe (PID: 6776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

AssemblyVersion: 1.1.0.6578
ProductName: Andy OS
OriginalFileName: GenericSetup.exe
LegalTrademarks: -
LegalCopyright: Copyright © Adaware 2023
InternalName: AR001.exe
FileDescription: Andy OS
CompanyName: Andy OS Inc.
Comments: -
ProductVersion: 1.0.0.0
FileVersion: 1.0.0.0
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x3fffc6
UninitializedDataSize: -
InitializedDataSize: 373248
CodeSize: 4186112
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2023:03:27 19:34:19+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start searchapp.exe andy_47.260_1096_26_x64.exe #ADWARE andy_47.260_1096_26_x64.exe

Process information

PID
CMD
Path
Indicators
Parent process
5064"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\schannel.dll
c:\windows\system32\mskeyprotect.dll
c:\windows\system32\ntasn1.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptnet.dll
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
6396"C:\Users\admin\AppData\Local\Temp\Andy_47.260_1096_26_x64.exe" C:\Users\admin\AppData\Local\Temp\Andy_47.260_1096_26_x64.exe
explorer.exe
User:
admin
Company:
Andy OS Inc.
Integrity Level:
MEDIUM
Description:
Andy OS
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\andy_47.260_1096_26_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6776"C:\Users\admin\AppData\Local\Temp\Andy_47.260_1096_26_x64.exe" huac hpp=QzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXEFuZHlfNDcuMjYwXzEwOTZfMjZfeDY0LmV4ZQ==C:\Users\admin\AppData\Local\Temp\Andy_47.260_1096_26_x64.exe
Andy_47.260_1096_26_x64.exe
User:
admin
Company:
Andy OS Inc.
Integrity Level:
HIGH
Description:
Andy OS
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\andy_47.260_1096_26_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
16 141
Read events
16 019
Write events
113
Delete events
9

Modification events

(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\DynamicSearchBox
Operation:writeName:TelemetryID
Value:
0000652D7E99D04DDB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\DynamicSearchBox
Operation:writeName:TelemetryID
Value:
0000B2918099D04DDB01
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
50667
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:897424053A4A887AC098380291034D885C8714B9
Value:
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\897424053A4A887AC098380291034D885C8714B9
Operation:writeName:Blob
Value:
0400000001000000100000003A07E20B54916395FD01E57B71AA46BE0F0000000100000040000000F9E4BD19674BF9924D2D527BE02A77CA045B818F0FB627C6AA3344F3BB09CBD346D02C7530389E58A22355CA95280F134B83E7FA08D59B961B0F9A05347855A0030000000100000014000000897424053A4A887AC098380291034D885C8714B91D000000010000001000000023787A60050FFA2D3210923F0F56237114000000010000001400000082BAD63D97CE9FCF71E89237AFFDB3B5693557CF090000000100000016000000301406082B0601050507030306082B06010505070308620000000100000020000000B80847FDA453BF6ED876CA7BC046A2481909E15B6ED376E665E7AD09F3864E710B000000010000007400000045006E0074007200750073007400200043006F006400650020005300690067006E0069006E006700200052006F006F0074002000430065007200740069006600690063006100740069006F006E00200041007500740068006F00720069007400790020002D002000430053004200520031000000190000000100000010000000188A164A11CAA2378C0BCDEC471F26732000000001000000A6050000308205A23082038AA00302010202147FF1A8F9F43AE8876E2DC6FF5E433DB2EE30A643300D06092A864886F70D01010D05003069310B300906035504061302555331163014060355040A0C0D456E74727573742C20496E632E3142304006035504030C39456E747275737420436F6465205369676E696E6720526F6F742043657274696669636174696F6E20417574686F72697479202D204353425231301E170D3231303530373133323633365A170D3430313233303133323633365A3069310B300906035504061302555331163014060355040A0C0D456E74727573742C20496E632E3142304006035504030C39456E747275737420436F6465205369676E696E6720526F6F742043657274696669636174696F6E20417574686F72697479202D20435342523130820222300D06092A864886F70D01010105000382020F003082020A0282020100A7818FF71445B66243F2D8AED3255E484F51BFC57D9F501C35D1D67E612A94196D2746A4A61A5DF754516A8022C6A866754D5483C95E681BABF65B64B0ADAD20BD54EF466B6D02E745AE75F68E8AB9322E8BB8771C524D79885FA53A18C9502C97272DBFDA007D637FEF32EC468763DB9A9FC35A21367BF99BD5CAA06E722CFCE1F19E704D0856156F90ABFB48BAB9D7C1827885652E7FB5C9C0E214B737114106E28AE0A8F6E57EB6780501C360ED4F07412E0A1349E3909B7FDDBDFAACBF6451D15C9BB4F55CE75CFF3B9BA5A01AD77D09B2C2B7FF6E1CBCC87DE6E92BFC72B314E94A5512849C4425751DF62AF04FA5203D6825EB61977C0FE5B63DF3AEC3C111BC1B8ECCE047305E42008671E358AC06CA651F7B94A64B57670C7E5EAD78675B55E35EEBC7D8EC4C6E86CBF3DCF89F87AA7258120F7DA6F8F842393B3C2CE4324D498CE0E100C238A09CFA843E41DC6E56AEC61A5BF467680501CD1BBFAE87BC9D53F62EE8B66BE499DEC54F8758A8D2651EC81FD5726EEE591C573B09729DD7CAB790C6CD7B45929142034C7D3FCAF2AAB8C20E86F3109F462EA46686685A68187029381180606B8A43A3736CE3B36B37FFE69D67019286DF2F48D1FB5060D55CFE21D3014263FEEF70B417C08FA8EED3C14B5F12EAFDFD2E0E874460E3A9F4C218A3E3FDCE0C84220DF3A778DA93F3DB38CFB92F33C6FF073C5EBE45D30203010001A3423040301D0603551D0E0416041482BAD63D97CE9FCF71E89237AFFDB3B5693557CF300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186300D06092A864886F70D01010D0500038202010012EF38A188E1A1A3D665DC479CF3BCDCCFAC4B8C3C1ABE2BF4F7D0671768864D70A8F2CDD03102577DA90C8A3B57399EF06EF724220567D1C196C1BED1F0F856670BDEBAD7889B8DD76B0876F55891D9B5C340531AA4F185CD3F004E3F4E933B78B9D20752640C86696DE854655617E80053848AF3DBFBB3CE0B55628FCD4C4906387F52C3F31CD73DF733CA32ADC1A9AF6FEB11CBEEAC51BFB0269A7A4E23B44AF669B44269D6A08DB68C474A3B2037B74107EF2F20D8661C6997A86C307C77435E6BBE2698830F3AD6C7702A16462D25548663655742F72341E9506A0743CE4EB5E91F68D8D8D6094AA8E8B2FC906792E49026F347FAD620FB8980E2447339F78A86330BF8AAA9E74DECDC6FD5CF314DAB8E1F9040D67C5C820FAE175271E9ACE74D38ED2AD8767987AD17A34CABB74257BF06ACE5D04D30E9554FE345CAF3E06A21348DC79F1CA3634892D29607BEA5473EC22A9938A78EDA217C516DDCCB3D07E9A9BD49D45D355F5B8C0451EA9A5890BA1BAF6878B1160F94293B8F9B2A8FC920F071424C5C4DAB318CABE97F266869A0A5160D81C4D1050CC38766E50763AA1B4EFFB207414FA5224650AC660087526C3CB23B9C97A146B45BDECFC26A5955078CA3A4D177356746042FD938B946AFBA8E1B7226022F7654EF83C22F2C7770CC771092AA03ADCACCE04FE98346E5B33C196F7A7987B6389ABD42CEA462
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\897424053A4A887AC098380291034D885C8714B9
Operation:writeName:Blob
Value:
5C000000010000000400000000100000190000000100000010000000188A164A11CAA2378C0BCDEC471F26730B000000010000007400000045006E0074007200750073007400200043006F006400650020005300690067006E0069006E006700200052006F006F0074002000430065007200740069006600690063006100740069006F006E00200041007500740068006F00720069007400790020002D002000430053004200520031000000620000000100000020000000B80847FDA453BF6ED876CA7BC046A2481909E15B6ED376E665E7AD09F3864E71090000000100000016000000301406082B0601050507030306082B0601050507030814000000010000001400000082BAD63D97CE9FCF71E89237AFFDB3B5693557CF1D000000010000001000000023787A60050FFA2D3210923F0F562371030000000100000014000000897424053A4A887AC098380291034D885C8714B90F0000000100000040000000F9E4BD19674BF9924D2D527BE02A77CA045B818F0FB627C6AA3344F3BB09CBD346D02C7530389E58A22355CA95280F134B83E7FA08D59B961B0F9A05347855A00400000001000000100000003A07E20B54916395FD01E57B71AA46BE2000000001000000A6050000308205A23082038AA00302010202147FF1A8F9F43AE8876E2DC6FF5E433DB2EE30A643300D06092A864886F70D01010D05003069310B300906035504061302555331163014060355040A0C0D456E74727573742C20496E632E3142304006035504030C39456E747275737420436F6465205369676E696E6720526F6F742043657274696669636174696F6E20417574686F72697479202D204353425231301E170D3231303530373133323633365A170D3430313233303133323633365A3069310B300906035504061302555331163014060355040A0C0D456E74727573742C20496E632E3142304006035504030C39456E747275737420436F6465205369676E696E6720526F6F742043657274696669636174696F6E20417574686F72697479202D20435342523130820222300D06092A864886F70D01010105000382020F003082020A0282020100A7818FF71445B66243F2D8AED3255E484F51BFC57D9F501C35D1D67E612A94196D2746A4A61A5DF754516A8022C6A866754D5483C95E681BABF65B64B0ADAD20BD54EF466B6D02E745AE75F68E8AB9322E8BB8771C524D79885FA53A18C9502C97272DBFDA007D637FEF32EC468763DB9A9FC35A21367BF99BD5CAA06E722CFCE1F19E704D0856156F90ABFB48BAB9D7C1827885652E7FB5C9C0E214B737114106E28AE0A8F6E57EB6780501C360ED4F07412E0A1349E3909B7FDDBDFAACBF6451D15C9BB4F55CE75CFF3B9BA5A01AD77D09B2C2B7FF6E1CBCC87DE6E92BFC72B314E94A5512849C4425751DF62AF04FA5203D6825EB61977C0FE5B63DF3AEC3C111BC1B8ECCE047305E42008671E358AC06CA651F7B94A64B57670C7E5EAD78675B55E35EEBC7D8EC4C6E86CBF3DCF89F87AA7258120F7DA6F8F842393B3C2CE4324D498CE0E100C238A09CFA843E41DC6E56AEC61A5BF467680501CD1BBFAE87BC9D53F62EE8B66BE499DEC54F8758A8D2651EC81FD5726EEE591C573B09729DD7CAB790C6CD7B45929142034C7D3FCAF2AAB8C20E86F3109F462EA46686685A68187029381180606B8A43A3736CE3B36B37FFE69D67019286DF2F48D1FB5060D55CFE21D3014263FEEF70B417C08FA8EED3C14B5F12EAFDFD2E0E874460E3A9F4C218A3E3FDCE0C84220DF3A778DA93F3DB38CFB92F33C6FF073C5EBE45D30203010001A3423040301D0603551D0E0416041482BAD63D97CE9FCF71E89237AFFDB3B5693557CF300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186300D06092A864886F70D01010D0500038202010012EF38A188E1A1A3D665DC479CF3BCDCCFAC4B8C3C1ABE2BF4F7D0671768864D70A8F2CDD03102577DA90C8A3B57399EF06EF724220567D1C196C1BED1F0F856670BDEBAD7889B8DD76B0876F55891D9B5C340531AA4F185CD3F004E3F4E933B78B9D20752640C86696DE854655617E80053848AF3DBFBB3CE0B55628FCD4C4906387F52C3F31CD73DF733CA32ADC1A9AF6FEB11CBEEAC51BFB0269A7A4E23B44AF669B44269D6A08DB68C474A3B2037B74107EF2F20D8661C6997A86C307C77435E6BBE2698830F3AD6C7702A16462D25548663655742F72341E9506A0743CE4EB5E91F68D8D8D6094AA8E8B2FC906792E49026F347FAD620FB8980E2447339F78A86330BF8AAA9E74DECDC6FD5CF314DAB8E1F9040D67C5C820FAE175271E9ACE74D38ED2AD8767987AD17A34CABB74257BF06ACE5D04D30E9554FE345CAF3E06A21348DC79F1CA3634892D29607BEA5473EC22A9938A78EDA217C516DDCCB3D07E9A9BD49D45D355F5B8C0451EA9A5890BA1BAF6878B1160F94293B8F9B2A8FC920F071424C5C4DAB318CABE97F266869A0A5160D81C4D1050CC38766E50763AA1B4EFFB207414FA5224650AC660087526C3CB23B9C97A146B45BDECFC26A5955078CA3A4D177356746042FD938B946AFBA8E1B7226022F7654EF83C22F2C7770CC771092AA03ADCACCE04FE98346E5B33C196F7A7987B6389ABD42CEA462
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:8CF427FD790C3AD166068DE81E57EFBB932272D4
Value:
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4
Operation:writeName:Blob
Value:
0400000001000000100000004BE2C99196650CF40E5A9392A00AFEB21D0000000100000010000000521B5F4582C1DCAAE381B05E37CA2D340B000000010000001800000045006E00740072007500730074002E006E006500740000007F000000010000002C000000302A060A2B0601040182370A030406082B0601050507030506082B0601050507030606082B06010505070307090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703080F0000000100000020000000FDE5F2D9CE2026E1E10064C0A468C9F355B90ACF85BAF5CE6F52D4016837FD940300000001000000140000008CF427FD790C3AD166068DE81E57EFBB932272D4190000000100000010000000FA46CE7CBB85CFB4310075313A09EE05530000000100000041000000303F3020060A6086480186FA6C0A010230123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C062000000010000002000000043DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F3391400000001000000140000006A72267AD01EEF7DE73B6951D46C8D9F901266AB7E000000010000000800000000C001B39667D6012000000001000000420400003082043E30820326A00302010202044A538C28300D06092A864886F70D01010B05003081BE310B300906035504061302555331163014060355040A130D456E74727573742C20496E632E31283026060355040B131F536565207777772E656E74727573742E6E65742F6C6567616C2D7465726D7331393037060355040B1330286329203230303920456E74727573742C20496E632E202D20666F7220617574686F72697A656420757365206F6E6C793132303006035504031329456E747275737420526F6F742043657274696669636174696F6E20417574686F72697479202D204732301E170D3039303730373137323535345A170D3330313230373137353535345A3081BE310B300906035504061302555331163014060355040A130D456E74727573742C20496E632E31283026060355040B131F536565207777772E656E74727573742E6E65742F6C6567616C2D7465726D7331393037060355040B1330286329203230303920456E74727573742C20496E632E202D20666F7220617574686F72697A656420757365206F6E6C793132303006035504031329456E747275737420526F6F742043657274696669636174696F6E20417574686F72697479202D20473230820122300D06092A864886F70D01010105000382010F003082010A0282010100BA84B672DB9E0C6BE299E93001A776EA32B895411AC9DA614E5872CFFEF68279BF7361060AA527D8B35FD3454E1C72D64E32F2728A0FF78319D06A808000451EB0C7E79ABF1257271CA3682F0A87BD6A6B0E5E65F31C77D5D4858D7021B4B332E78BA2D5863902B1B8D247CEE4C949C43BA7DEFB547D57BEF0E86EC279B23A0B55E250981632135C2F7856C1C294B3F25AE4279A9F24D7C6ECD09B2582E3CCC2C445C58C977A066B2A119FA90A6E483B6FDBD4111942F78F07BFF5535F9C3EF4172CE669AC4E324C6277EAB7E8E5BB34BC198BAE9C51E7B77EB553B13322E56DCF703C1AFAE29B67B683F48DA5AF624C4DE058AC64341203F8B68D946324A4710203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604146A72267AD01EEF7DE73B6951D46C8D9F901266AB300D06092A864886F70D01010B05000382010100799F1D96C6B6793F228D87D3870304606A6B9A2E59897311AC43D1F513FF8D392BC0F2BD4F708CA92FEA17C40B549ED41B9698333CA8AD62A20076AB59696E061D7EC4B9448D98AF12D461DB0A194647F3EBF763C1400540A5D2B7F4B59A36BFA98876880455042B9C877F1A373C7E2DA51AD8D4895ECABDAC3D6CD86DAFD5F3760FCD3B8838229D6C939AC43DBF821B653FA60F5DAAFCE5B215CAB5ADC6BC3DD084E8EA0672B04D393278BF3E119C0BA49D9A21F3F09B0B3078DBC1DC8743FEBC639ACAC5C21CC9C78DFF3B125808E6B63DEC7A2C4EFB8396CE0C3C69875473A473C293FF5110AC155401D8FC05B189A17F74839A49D7DC4E7B8A486F8B45F6
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4
Operation:writeName:Blob
Value:
5C0000000100000004000000000800007E000000010000000800000000C001B39667D6011400000001000000140000006A72267AD01EEF7DE73B6951D46C8D9F901266AB62000000010000002000000043DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339530000000100000041000000303F3020060A6086480186FA6C0A010230123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0190000000100000010000000FA46CE7CBB85CFB4310075313A09EE050300000001000000140000008CF427FD790C3AD166068DE81E57EFBB932272D40F0000000100000020000000FDE5F2D9CE2026E1E10064C0A468C9F355B90ACF85BAF5CE6F52D4016837FD94090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703087F000000010000002C000000302A060A2B0601040182370A030406082B0601050507030506082B0601050507030606082B060105050703070B000000010000001800000045006E00740072007500730074002E006E006500740000001D0000000100000010000000521B5F4582C1DCAAE381B05E37CA2D340400000001000000100000004BE2C99196650CF40E5A9392A00AFEB22000000001000000420400003082043E30820326A00302010202044A538C28300D06092A864886F70D01010B05003081BE310B300906035504061302555331163014060355040A130D456E74727573742C20496E632E31283026060355040B131F536565207777772E656E74727573742E6E65742F6C6567616C2D7465726D7331393037060355040B1330286329203230303920456E74727573742C20496E632E202D20666F7220617574686F72697A656420757365206F6E6C793132303006035504031329456E747275737420526F6F742043657274696669636174696F6E20417574686F72697479202D204732301E170D3039303730373137323535345A170D3330313230373137353535345A3081BE310B300906035504061302555331163014060355040A130D456E74727573742C20496E632E31283026060355040B131F536565207777772E656E74727573742E6E65742F6C6567616C2D7465726D7331393037060355040B1330286329203230303920456E74727573742C20496E632E202D20666F7220617574686F72697A656420757365206F6E6C793132303006035504031329456E747275737420526F6F742043657274696669636174696F6E20417574686F72697479202D20473230820122300D06092A864886F70D01010105000382010F003082010A0282010100BA84B672DB9E0C6BE299E93001A776EA32B895411AC9DA614E5872CFFEF68279BF7361060AA527D8B35FD3454E1C72D64E32F2728A0FF78319D06A808000451EB0C7E79ABF1257271CA3682F0A87BD6A6B0E5E65F31C77D5D4858D7021B4B332E78BA2D5863902B1B8D247CEE4C949C43BA7DEFB547D57BEF0E86EC279B23A0B55E250981632135C2F7856C1C294B3F25AE4279A9F24D7C6ECD09B2582E3CCC2C445C58C977A066B2A119FA90A6E483B6FDBD4111942F78F07BFF5535F9C3EF4172CE669AC4E324C6277EAB7E8E5BB34BC198BAE9C51E7B77EB553B13322E56DCF703C1AFAE29B67B683F48DA5AF624C4DE058AC64341203F8B68D946324A4710203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604146A72267AD01EEF7DE73B6951D46C8D9F901266AB300D06092A864886F70D01010B05000382010100799F1D96C6B6793F228D87D3870304606A6B9A2E59897311AC43D1F513FF8D392BC0F2BD4F708CA92FEA17C40B549ED41B9698333CA8AD62A20076AB59696E061D7EC4B9448D98AF12D461DB0A194647F3EBF763C1400540A5D2B7F4B59A36BFA98876880455042B9C877F1A373C7E2DA51AD8D4895ECABDAC3D6CD86DAFD5F3760FCD3B8838229D6C939AC43DBF821B653FA60F5DAAFCE5B215CAB5ADC6BC3DD084E8EA0672B04D393278BF3E119C0BA49D9A21F3F09B0B3078DBC1DC8743FEBC639ACAC5C21CC9C78DFF3B125808E6B63DEC7A2C4EFB8396CE0C3C69875473A473C293FF5110AC155401D8FC05B189A17F74839A49D7DC4E7B8A486F8B45F6
(PID) Process:(6776) Andy_47.260_1096_26_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Andy_47_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
22
Suspicious files
105
Text files
221
Unknown types
2

Dropped files

PID
Process
Filename
Type
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\msvcp140.dllexecutable
MD5:8FF1898897F3F4391803C7253366A87B
SHA256:51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_869AEB7B80415348197BF34395674A06binary
MD5:A21B5A320B1074DD622FFBDD88CF5BEE
SHA256:20FB2BA6509C49BD9FA0D86C81F9D76C477E6D376B991AEEA75229FF17F3F977
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\OfferSDK.dllexecutable
MD5:1105B8B33B0F019651566B87959512E2
SHA256:9A059883BEE5177723B1A971172010A349DB64C1DD60FCB3BBF190FE0E78BB07
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43Dder
MD5:58D83B00E42167E516E3BCB6BD37B090
SHA256:D13720C172D0DB4B0B55039426BB6476697B2ADF4A852F2E2595282E45DAC367
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FFder
MD5:22E2FB11DAD84EB8802C3CC94D23F0BF
SHA256:B1E43A1A701632DF73508856CD6D4670C30ACEE60508F507D2DF0A87C8AF0961
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\H2ODAL.dllexecutable
MD5:D7134E64BDCE2EA5FA7504781A57ADAA
SHA256:F28041AB9EDB612DA9E7C42BB4D940E69FB440D4CB786F969512E0B61E54E637
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.Net.dllexecutable
MD5:FC3BE382CC3A7B4FAFEE4FDD465CAB2E
SHA256:42C2156B7EEE3BF8BEE8D0C1D3D3F138E059DDDA342CF8EE0D723130FB865304
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\Ninject.dllexecutable
MD5:8DB691813A26E7D0F1DB5E2F4D0D05E3
SHA256:3043A65F11AC204E65BCA142FF4166D85F1B22078B126B806F1FECB2A315C701
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dllexecutable
MD5:26D7A9A819AD38801857D657DA7B43DA
SHA256:43BAD9C77F861C5CE0F622896A33DBD8C34157C004550CAC22CC97D3A4BA3052
6396Andy_47.260_1096_26_x64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FFbinary
MD5:90487F8D632F79FC32628FB8F6BAFB90
SHA256:5F7DEE8B37485B089EFBA0E4481D702D67F2B67ACAB80B5E2ED5BA3031519235
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
56
DNS requests
35
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6396
Andy_47.260_1096_26_x64.exe
GET
200
2.19.216.247:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
—
—
whitelisted
6396
Andy_47.260_1096_26_x64.exe
GET
200
2.19.216.247:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCEBh0NsmIOct9rTne%2FAjdFO0%3D
unknown
—
—
whitelisted
—
—
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6396
Andy_47.260_1096_26_x64.exe
GET
200
2.19.216.247:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
—
—
whitelisted
6312
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6776
Andy_47.260_1096_26_x64.exe
GET
—
34.196.126.4:80
http://dl.andyroid.net/andy_latest.exe
unknown
—
—
—
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6312
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4076
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1016
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
23.212.110.144:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
1076
svchost.exe
184.30.17.189:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6396
Andy_47.260_1096_26_x64.exe
2.19.216.247:80
ocsp.entrust.net
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
www.bing.com
  • 23.212.110.144
  • 23.212.110.162
whitelisted
ocsp.entrust.net
  • 2.19.216.247
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.google.com
  • 142.250.186.68
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5 ETPRO signatures available at the full report
Process
Message
Andy_47.260_1096_26_x64.exe
at sciter:init-script.tis
Andy_47.260_1096_26_x64.exe
Andy_47.260_1096_26_x64.exe
Andy_47.260_1096_26_x64.exe
Error: File not found - sciterwrapper:console.tis
Andy_47.260_1096_26_x64.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Andy_47.260_1096_26_x64.exe
Andy_47.260_1096_26_x64.exe
at sciter:init-script.tis
Andy_47.260_1096_26_x64.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Andy_47.260_1096_26_x64.exe
Error: File not found - sciterwrapper:console.tis
Andy_47.260_1096_26_x64.exe
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Andy_47.260_1096_26_x64.exe