File name:

RC-M.rar

Full analysis: https://app.any.run/tasks/a8176071-1f66-4736-a573-4eb0bf51dad1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 17, 2020, 21:52:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

FD3BE5F7B45EDAA34478217B25F367E8

SHA1:

479B712831DA381D88518AC5349617224DA35D03

SHA256:

27725B3F0F239241D8C31CB825954AB0735EC76071561CE5E153911449BAB867

SSDEEP:

49152:m+/KsQu/T+FqN3NoHyTITuk0meHR/N+JkJ3kmIjlpOmmowp3Jg6vzG:mRsQubt3NsyTIKQQ/N5Ujhf1wLg2zG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • RC-M (beta).exe (PID: 1904)
      • RestoroSetup.exe (PID: 3848)

    • Application was dropped or rewritten from another process

      • Synaptics.exe (PID: 2300)
      • Restoro.exe (PID: 3932)
      • Restoro.exe (PID: 2852)
      • sqlite3.exe (PID: 1888)
      • sqlite3.exe (PID: 3836)
      • sqlite3.exe (PID: 3612)
      • sqlite3.exe (PID: 1520)
      • sqlite3.exe (PID: 236)
      • nsC129.tmp (PID: 2064)
      • sqlite3.exe (PID: 2176)
      • sqlite3.exe (PID: 1576)
      • nsBFA0.tmp (PID: 2828)
      • nsC273.tmp (PID: 2668)
      • nsC3CC.tmp (PID: 1752)
      • nsC96A.tmp (PID: 3376)
      • nsF202.tmp (PID: 3288)
      • ns1673.tmp (PID: 2896)
      • ns1C21.tmp (PID: 2488)
      • ns2318.tmp (PID: 620)
      • sqlite3.exe (PID: 2776)
      • sqlite3.exe (PID: 3972)
      • sqlite3.exe (PID: 504)
      • ns256B.tmp (PID: 3784)
      • ns2BC5.tmp (PID: 952)
      • ns321F.tmp (PID: 1552)
      • sqlite3.exe (PID: 3316)
      • ns3D3B.tmp (PID: 2896)
      • sqlite3.exe (PID: 3516)
      • ns42CA.tmp (PID: 1792)
      • ns4FFB.tmp (PID: 792)
      • ns5200.tmp (PID: 3748)
      • lzma.exe (PID: 1792)
      • ns4D4B.tmp (PID: 3216)
      • lzma.exe (PID: 3332)
      • ns5DC9.tmp (PID: 884)
      • ns65B2.tmp (PID: 3808)
      • RestoroUpdater.exe (PID: 284)
      • ns87B2.tmp (PID: 2904)
      • RestoroServiceSetup.exe (PID: 1552)
      • ns966A.tmp (PID: 912)
      • RestoroService.exe (PID: 3240)
      • RestoroProtection.exe (PID: 3368)
      • RestoroProtection.exe (PID: 2404)
      • RestoroSetup.exe (PID: 3848)
      • ns8CE3.tmp (PID: 3552)
      • nsB754.tmp (PID: 3312)
      • RestoroMain.exe (PID: 1576)
      • RestoroApp.exe (PID: 2284)
      • RestoroAM.exe (PID: 3840)
      • nsAFA3.tmp (PID: 3176)

    • Loads dropped or rewritten executable

      • Restoro.exe (PID: 2852)
      • RestoroSetup.exe (PID: 3848)
      • regsvr32.exe (PID: 2292)
      • regsvr32.exe (PID: 3324)
      • RestoroUpdater.exe (PID: 284)
      • RestoroServiceSetup.exe (PID: 1552)
      • RestoroMain.exe (PID: 1576)
      • explorer.exe (PID: 352)
      • ._cache_RC-M (beta).exe (PID: 3628)
      • ._cache_RC-M (beta).exe (PID: 292)
      • RestoroAM.exe (PID: 3840)

    • Connects to CnC server

      • Synaptics.exe (PID: 2300)

    • Uses TASKLIST.EXE to search for antiviruses

      • cmd.exe (PID: 252)
      • cmd.exe (PID: 1468)

    • Changes settings of System certificates

      • Synaptics.exe (PID: 2300)
      • RestoroMain.exe (PID: 1576)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Restoro.exe (PID: 2852)
      • RestoroSetup.exe (PID: 3848)

    • Uses TASKLIST.EXE to search for security tools

      • cmd.exe (PID: 2952)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 1724)
      • cmd.exe (PID: 3248)

    • Downloads executable files from the Internet

      • Restoro.exe (PID: 2852)
      • RestoroUpdater.exe (PID: 284)

    • Loads the Task Scheduler COM API

      • RestoroProtection.exe (PID: 3368)
      • schtasks.exe (PID: 2612)
      • RestoroMain.exe (PID: 1576)

    • Uses Task Scheduler to run other applications

      • nsB754.tmp (PID: 3312)

  • SUSPICIOUS

    • Creates files in the program directory

      • RC-M (beta).exe (PID: 1904)
      • Restoro.exe (PID: 2852)
      • RestoroSetup.exe (PID: 3848)
      • lzma.exe (PID: 3332)
      • lzma.exe (PID: 1792)
      • RestoroUpdater.exe (PID: 284)
      • RestoroServiceSetup.exe (PID: 1552)
      • RestoroProtection.exe (PID: 3368)
      • RestoroProtection.exe (PID: 2404)
      • RestoroMain.exe (PID: 1576)

    • Executable content was dropped or overwritten

      • RC-M (beta).exe (PID: 1904)
      • chrome.exe (PID: 3880)
      • chrome.exe (PID: 4000)
      • Restoro.exe (PID: 2852)
      • RestoroSetup.exe (PID: 3848)
      • lzma.exe (PID: 1792)
      • lzma.exe (PID: 3332)
      • RestoroUpdater.exe (PID: 284)
      • RestoroServiceSetup.exe (PID: 1552)
      • DllHost.exe (PID: 792)
      • WinRAR.exe (PID: 2876)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4000)

    • Creates files in the Windows directory

      • Restoro.exe (PID: 2852)

    • Reads the cookies of Mozilla Firefox

      • sqlite3.exe (PID: 1888)
      • sqlite3.exe (PID: 3516)
      • sqlite3.exe (PID: 3612)
      • sqlite3.exe (PID: 2776)
      • RestoroProtection.exe (PID: 2404)

    • Starts CMD.EXE for commands execution

      • nsBFA0.tmp (PID: 2828)
      • nsC129.tmp (PID: 2064)
      • nsC3CC.tmp (PID: 1752)
      • nsC273.tmp (PID: 2668)
      • nsC96A.tmp (PID: 3376)
      • nsF202.tmp (PID: 3288)
      • ns1673.tmp (PID: 2896)
      • ns1C21.tmp (PID: 2488)
      • ns2318.tmp (PID: 620)
      • ns256B.tmp (PID: 3784)
      • ns2BC5.tmp (PID: 952)
      • ns321F.tmp (PID: 1552)
      • ns3D3B.tmp (PID: 2896)
      • ns42CA.tmp (PID: 1792)
      • ns5200.tmp (PID: 3748)
      • ns65B2.tmp (PID: 3808)
      • ns87B2.tmp (PID: 2904)
      • ns8CE3.tmp (PID: 3552)
      • nsAFA3.tmp (PID: 3176)

    • Reads the cookies of Google Chrome

      • sqlite3.exe (PID: 2176)
      • sqlite3.exe (PID: 236)
      • sqlite3.exe (PID: 1520)
      • sqlite3.exe (PID: 3836)
      • sqlite3.exe (PID: 3316)
      • sqlite3.exe (PID: 1576)
      • sqlite3.exe (PID: 504)
      • sqlite3.exe (PID: 3972)
      • RestoroProtection.exe (PID: 2404)

    • Creates files in the user directory

      • sqlite3.exe (PID: 1888)
      • sqlite3.exe (PID: 3612)
      • sqlite3.exe (PID: 3516)
      • Restoro.exe (PID: 2852)
      • Synaptics.exe (PID: 2300)
      • sqlite3.exe (PID: 2776)
      • RestoroProtection.exe (PID: 3368)
      • RestoroMain.exe (PID: 1576)
      • RestoroProtection.exe (PID: 2404)
      • explorer.exe (PID: 352)

    • Starts application with an unusual extension

      • Restoro.exe (PID: 2852)
      • RestoroSetup.exe (PID: 3848)
      • RestoroUpdater.exe (PID: 284)
      • RestoroServiceSetup.exe (PID: 1552)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 4064)
      • cmd.exe (PID: 2076)
      • cmd.exe (PID: 1468)
      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 3292)
      • cmd.exe (PID: 1248)

    • Adds / modifies Windows certificates

      • Synaptics.exe (PID: 2300)
      • RestoroMain.exe (PID: 1576)

    • Creates a software uninstall entry

      • Restoro.exe (PID: 2852)
      • RestoroSetup.exe (PID: 3848)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3032)
      • regsvr32.exe (PID: 2292)

    • Reads Environment values

      • RestoroProtection.exe (PID: 3368)

    • Reads Internet Cache Settings

      • RestoroProtection.exe (PID: 3368)
      • RestoroMain.exe (PID: 1576)
      • explorer.exe (PID: 352)

    • Executed as Windows Service

      • RestoroProtection.exe (PID: 2404)

    • Reads internet explorer settings

      • RestoroMain.exe (PID: 1576)

    • Uses IPCONFIG.EXE to discover IP address

      • RestoroMain.exe (PID: 1576)

    • Reads CPU info

      • RestoroMain.exe (PID: 1576)

    • Executed via COM

      • DllHost.exe (PID: 792)

  • INFO

    • Manual execution by user

      • RC-M (beta).exe (PID: 1904)
      • RC-M (beta).exe (PID: 2084)
      • chrome.exe (PID: 4000)
      • RC-M (beta).exe (PID: 2176)
      • opera.exe (PID: 1940)
      • explorer.exe (PID: 3152)
      • WinRAR.exe (PID: 2876)

    • Application launched itself

      • chrome.exe (PID: 4000)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3880)
      • chrome.exe (PID: 4000)
      • RestoroMain.exe (PID: 1576)

    • Reads the hosts file

      • chrome.exe (PID: 3880)
      • chrome.exe (PID: 4000)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 4000)

    • Changes settings of System certificates

      • chrome.exe (PID: 3880)

    • Creates files in the user directory

      • opera.exe (PID: 1940)

    • Dropped object may contain TOR URL's

      • chrome.exe (PID: 4000)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 3880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
249
Monitored processes
162
Malicious processes
21
Suspicious processes
23

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs rc-m (beta).exe ._cache_rc-m (beta).exe no specs synaptics.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs rc-m (beta).exe no specs ._cache_rc-m (beta).exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs rc-m (beta).exe no specs ._cache_rc-m (beta).exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs restoro.exe no specs restoro.exe nsbfa0.tmp no specs cmd.exe no specs sqlite3.exe no specs sqlite3.exe no specs sqlite3.exe no specs nsc129.tmp no specs cmd.exe no specs sqlite3.exe no specs sqlite3.exe no specs sqlite3.exe no specs nsc273.tmp no specs cmd.exe no specs sqlite3.exe no specs sqlite3.exe no specs sqlite3.exe no specs nsc3cc.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs nsc96a.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs regsvr32.exe no specs chrome.exe no specs nsf202.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ns1673.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs opera.exe ns1c21.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs ns2318.tmp no specs cmd.exe no specs sqlite3.exe no specs sqlite3.exe no specs sqlite3.exe no specs ns256b.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs ns2bc5.tmp no specs cmd.exe no specs tasklist.exe no specs ns321f.tmp no specs cmd.exe no specs tasklist.exe no specs restorosetup.exe ns3d3b.tmp no specs cmd.exe no specs tasklist.exe no specs ns42ca.tmp no specs cmd.exe no specs tasklist.exe no specs ns4d4b.tmp no specs lzma.exe ns4ffb.tmp no specs lzma.exe ns5200.tmp no specs cmd.exe no specs tasklist.exe no specs regsvr32.exe no specs regsvr32.exe no specs ns5dc9.tmp no specs restoroupdater.exe ns65b2.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs chrome.exe no specs restoroservicesetup.exe ns87b2.tmp no specs cmd.exe no specs tasklist.exe no specs ns8ce3.tmp no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs ns966a.tmp no specs restoroprotection.exe chrome.exe no specs restoroprotection.exe restoroservice.exe chrome.exe no specs nsafa3.tmp no specs cmd.exe no specs tasklist.exe no specs nsb754.tmp no specs schtasks.exe no specs restoroapp.exe no specs restoromain.exe ipconfig.exe no specs restoroam.exe no specs explorer.exe no specs ipconfig.exe no specs winrar.exe Copy/Move/Rename/Delete/Link Object explorer.exe no specs rc-m (beta).exe no specs ._cache_rc-m (beta).exe rc-m (beta).exe no specs ._cache_rc-m (beta).exe

Process information

PID
CMD
Path
Indicators
Parent process
184"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,10241672821989984632,13647356823946140552,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=17148270870159496742 --mojo-platform-channel-handle=3944 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
236"C:\Users\admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%restoro.com' and name like '_trackid_product_24_%';"C:\Users\admin\AppData\Local\Temp\sqlite3.exe—Restoro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sqlite3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
252cmd /C tasklist /FI "IMAGENAME eq avupdate.exe" > C:\Users\admin\AppData\Local\Temp\IsProcessActive.txtC:\Windows\system32\cmd.exe—nsC96A.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
284cmd /c ""C:\Users\admin\AppData\Local\Temp\FF.bat" > C:\Users\admin\AppData\Local\Temp\FF.txt"C:\Windows\system32\cmd.exe—nsC273.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
284"C:\Users\admin\AppData\Local\Temp\nsm3BF2.tmp\RestoroUpdater.exe" /S /MinorSessionID=3e3aca4923ec4cb69f20eb9e0c /SessionID=D103199D-3C3F-AB45-A928-AB014D429B1F /TrackID= /AgentLogLocation=C:\C:\ProgramData\Restoro\bin\results /CflLocation=C:\ProgramData\Restoro\cfl.rei /Install=True /DownloaderVersion=2016 /Iav=FalseC:\Users\admin\AppData\Local\Temp\nsm3BF2.tmp\RestoroUpdater.exe
ns5DC9.tmp
User:
admin
Company:
Restoro
Integrity Level:
HIGH
Description:
Restoro Active Protection Service
Exit code:
0
Version:
3.011
Modules
Images
c:\users\admin\appdata\local\temp\sqlite3.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\cmd.exe
c:\users\admin\appdata\local\temp\nsm3bf2.tmp\restoroupdater.exe
292"C:\Users\admin\Desktop\RC-M\._cache_RC-M (beta).exe" C:\Users\admin\Desktop\RC-M\._cache_RC-M (beta).exe
RC-M (beta).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\rc-m\._cache_rc-m (beta).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\d3d9.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
504"C:\Users\admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%restoro.com' and name='_country_product_24';"C:\Users\admin\AppData\Local\Temp\sqlite3.exe—Restoro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sqlite3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
564"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,10241672821989984632,13647356823946140552,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9520445902769958469 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
584"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,10241672821989984632,13647356823946140552,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16063732147134136173 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
16 848
Read events
15 239
Write events
1 521
Delete events
88

Modification events

(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1244) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RC-M.rar
(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
92
Suspicious files
288
Text files
602
Unknown types
59

Dropped files

PID
Process
Filename
Type
1244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1244.48815\RC-M\._cache_RC-M (beta).exe —
MD5:—
SHA256:—
1244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1244.48815\RC-M\cheatlib.dll —
MD5:—
SHA256:—
1244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1244.48815\RC-M\RC-M (beta).exe —
MD5:—
SHA256:—
352explorer.exeC:\Users\admin\Desktop\RC-M —
MD5:—
SHA256:—
1904RC-M (beta).exeC:\ProgramData\Synaptics\RCXDFFA.tmp —
MD5:—
SHA256:—
4000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\3ee3f7b2-8b84-41a2-a428-fb1451282e4e.tmp —
MD5:—
SHA256:—
4000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp —
MD5:—
SHA256:—
1904RC-M (beta).exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:—
SHA256:—
4000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
4000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF39ff2b.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
170
TCP/UDP connections
180
DNS requests
129
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3880
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
3880
chrome.exe
GET
200
69.16.175.10:80
http://cloud.restoro.com/web/assets/images/header-logo.png
US
image
3.74 Kb
shared
2852
Restoro.exe
GET
200
50.56.4.238:80
http://www.restoro.com/lib/version.php?type=version
US
xml
764 b
malicious
2852
Restoro.exe
GET
200
69.16.175.42:80
http://cloud.restoro.com/download/2016/RestoroSetup32.exe
US
executable
11.2 Mb
shared
3880
chrome.exe
GET
302
216.58.206.14:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
515 b
whitelisted
3880
chrome.exe
GET
302
216.58.206.14:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
510 b
whitelisted
2852
Restoro.exe
GET
200
50.56.4.238:80
http://www.restoro.com/lib/version.php?type=downloader
US
xml
335 b
malicious
3880
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAP%2B7xu1tkg0miCVD4vGl1M%3D
US
der
471 b
whitelisted
2852
Restoro.exe
GET
200
69.16.175.42:80
http://cloud.restoro.com/settings/conf.res
US
binary
956 Kb
shared
2300
Synaptics.exe
GET
200
204.140.20.21:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
US
text
31 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2300
Synaptics.exe
101.86.170.36:1199
xred.mooo.com
China Telecom (Group)
CN
suspicious
3880
chrome.exe
172.217.18.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3880
chrome.exe
172.217.18.173:443
accounts.google.com
Google Inc.
US
whitelisted
3880
chrome.exe
172.217.16.131:443
www.google.com.ua
Google Inc.
US
whitelisted
3880
chrome.exe
216.58.207.74:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3880
chrome.exe
172.217.18.163:443
www.gstatic.com
Google Inc.
US
whitelisted
3880
chrome.exe
172.217.23.163:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3880
chrome.exe
216.58.206.14:443
apis.google.com
Google Inc.
US
whitelisted
3880
chrome.exe
216.58.210.14:443
ogs.google.com
Google Inc.
US
whitelisted
3880
chrome.exe
172.217.23.100:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
xred.mooo.com
  • 101.86.170.36
suspicious
clientservices.googleapis.com
  • 172.217.18.3
whitelisted
accounts.google.com
  • 172.217.18.173
shared
www.google.com.ua
  • 172.217.16.131
whitelisted
fonts.googleapis.com
  • 216.58.207.74
whitelisted
www.gstatic.com
  • 172.217.18.163
whitelisted
fonts.gstatic.com
  • 172.217.23.163
whitelisted
apis.google.com
  • 216.58.206.14
whitelisted
ogs.google.com
  • 216.58.210.14
whitelisted
www.google.com
  • 172.217.23.100
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
2300
Synaptics.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Bloat-A
2852
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2852
Restoro.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
2852
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2852
Restoro.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
2852
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2852
Restoro.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
2852
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2852
Restoro.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
2 ETPRO signatures available at the full report
Process
Message
RestoroMain.exe
CFtpUpload::CFtpUpload() .
RestoroMain.exe
\EXE2.0.1.6\20200117\D103199D-3C3F-AB45-A928-AB014D429B1F\USER-PC\2155\
RestoroMain.exe
CFtpUpload::CFtpUpload() .
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RC-M.rar