File name:

ianygo.exe

Full analysis: https://app.any.run/tasks/9441e016-865a-4fcb-89c2-6ed26675045f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 10:39:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
adware
upx
delphi
inno
installer
vmprotect
cnc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

0ABF7A6DE998DC274E9113633771A0BD

SHA1:

DDD3F3033068C2FCD72F9C4C02DFAD4583399051

SHA256:

3119AB64E976FEF2420DA45282D122B328F2A3BB896D1FC401F6DF74EF9845AA

SSDEEP:

98304:jXuHPx1C6PGczmSLf1zrBKzYMjZtNWBrgNFd1Lr6Z42tHAKoQg9Vn/ctJmGu0ake:pN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • ianygo.exe (PID: 5212)

    • Executing a file with an untrusted certificate

      • QtWebEngineProcess.exe (PID: 2476)
      • QtWebEngineProcess.exe (PID: 5108)
      • mDNSResponder.exe (PID: 5740)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ianygo.exe (PID: 5212)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • autoInstall64.exe (PID: 7144)
      • DPInst64.exe (PID: 5404)

    • Checks for external IP

      • ianygo.exe (PID: 5212)
      • svchost.exe (PID: 2196)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • QtWebEngineProcess.exe (PID: 2476)

    • Access to an unwanted program domain was detected

      • ianygo.exe (PID: 5212)

    • Potential Corporate Privacy Violation

      • ianygo.exe (PID: 5212)

    • Executable content was dropped or overwritten

      • ianygo_net_4.8.1.exe (PID: 7548)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • drvinst.exe (PID: 732)
      • pnputil.exe (PID: 6592)
      • xcopy.exe (PID: 7512)
      • DPInst64.exe (PID: 5404)
      • drvinst.exe (PID: 4692)
      • drvinst.exe (PID: 7964)
      • drvinst.exe (PID: 1912)
      • drvinst.exe (PID: 7036)
      • drvinst.exe (PID: 2896)

    • Reads the Windows owner or organization settings

      • ianygo_net_4.8.1.tmp (PID: 4696)

    • Get information on the list of running processes

      • cmd.exe (PID: 2904)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • cmd.exe (PID: 7784)
      • Tenorshare iAnyGo.exe (PID: 6652)

    • Starts CMD.EXE for commands execution

      • ianygo_net_4.8.1.tmp (PID: 4696)
      • autoInstall64.exe (PID: 7144)
      • Tenorshare iAnyGo.exe (PID: 6652)

    • Process drops legitimate windows executable

      • ianygo_net_4.8.1.tmp (PID: 4696)
      • DPInst64.exe (PID: 5404)
      • drvinst.exe (PID: 4692)
      • drvinst.exe (PID: 7964)
      • drvinst.exe (PID: 2896)

    • Drops 7-zip archiver for unpacking

      • ianygo_net_4.8.1.tmp (PID: 4696)

    • Drops a system driver (possible attempt to evade defenses)

      • ianygo_net_4.8.1.tmp (PID: 4696)
      • pnputil.exe (PID: 6592)
      • drvinst.exe (PID: 732)
      • xcopy.exe (PID: 7512)
      • DPInst64.exe (PID: 5404)
      • drvinst.exe (PID: 7036)
      • drvinst.exe (PID: 1912)

    • Process drops legitimate windows executable (CertUtil.exe)

      • ianygo_net_4.8.1.tmp (PID: 4696)

    • There is functionality for taking screenshot (YARA)

      • Tenorshare iAnyGo.exe (PID: 6652)

    • The process drops C-runtime libraries

      • ianygo_net_4.8.1.tmp (PID: 4696)

    • Reads the date of Windows installation

      • autoInstall64.exe (PID: 7144)

    • Creates files in the driver directory

      • drvinst.exe (PID: 732)
      • drvinst.exe (PID: 7964)
      • drvinst.exe (PID: 4692)
      • drvinst.exe (PID: 2896)
      • drvinst.exe (PID: 7036)

    • Detected use of alternative data streams (AltDS)

      • Tenorshare iAnyGo.exe (PID: 6652)

    • Uses WMIC.EXE to obtain Windows Installer data

      • Tenorshare iAnyGo.exe (PID: 6652)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7896)

    • Uses WMIC.EXE

      • Tenorshare iAnyGo.exe (PID: 6652)

    • Creates a software uninstall entry

      • DPInst64.exe (PID: 5404)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6988)

  • INFO

    • Reads the computer name

      • ianygo.exe (PID: 5212)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • autoInstall64.exe (PID: 7144)
      • drvinst.exe (PID: 732)
      • mDNSResponder.exe (PID: 5740)
      • adb.exe (PID: 6068)
      • drvinst.exe (PID: 4692)
      • Update.exe (PID: 4988)
      • adb.exe (PID: 4304)

    • Checks supported languages

      • ianygo.exe (PID: 5212)
      • ianygo_net_4.8.1.exe (PID: 7548)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • autoInstall64.exe (PID: 7144)
      • drvinst.exe (PID: 732)
      • mDNSResponder.exe (PID: 5740)
      • AppleMobileDeviceProcess.exe (PID: 6168)
      • curl.exe (PID: 808)
      • InstallAndDriver.exe (PID: 7788)
      • adb.exe (PID: 6068)
      • DPInst64.exe (PID: 5404)
      • drvinst.exe (PID: 4692)
      • Update.exe (PID: 4988)

    • The sample compiled with english language support

      • ianygo.exe (PID: 5212)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • pnputil.exe (PID: 6592)
      • drvinst.exe (PID: 732)
      • xcopy.exe (PID: 7512)
      • DPInst64.exe (PID: 5404)
      • drvinst.exe (PID: 4692)
      • drvinst.exe (PID: 7964)
      • drvinst.exe (PID: 7036)
      • drvinst.exe (PID: 1912)
      • drvinst.exe (PID: 2896)

    • Checks proxy server information

      • ianygo.exe (PID: 5212)
      • slui.exe (PID: 7512)
      • Tenorshare iAnyGo.exe (PID: 6652)

    • Reads the machine GUID from the registry

      • ianygo.exe (PID: 5212)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • drvinst.exe (PID: 732)
      • drvinst.exe (PID: 4692)
      • DPInst64.exe (PID: 5404)
      • drvinst.exe (PID: 2896)
      • drvinst.exe (PID: 7036)

    • Creates files or folders in the user directory

      • ianygo.exe (PID: 5212)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • QtWebEngineProcess.exe (PID: 2476)

    • Creates files in the program directory

      • ianygo.exe (PID: 5212)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • DPInst64.exe (PID: 5404)

    • UPX packer has been detected

      • ianygo.exe (PID: 5212)

    • Create files in a temporary directory

      • ianygo_net_4.8.1.exe (PID: 7548)
      • ianygo.exe (PID: 5212)
      • ianygo_net_4.8.1.tmp (PID: 4696)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • pnputil.exe (PID: 6592)
      • xcopy.exe (PID: 7512)
      • DPInst64.exe (PID: 5404)

    • Reads the software policy settings

      • slui.exe (PID: 1244)
      • ianygo.exe (PID: 5212)
      • slui.exe (PID: 7512)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • drvinst.exe (PID: 7964)
      • drvinst.exe (PID: 4692)
      • rundll32.exe (PID: 7408)

    • Process checks computer location settings

      • ianygo_net_4.8.1.tmp (PID: 4696)
      • Tenorshare iAnyGo.exe (PID: 6652)
      • autoInstall64.exe (PID: 7144)

    • Compiled with Borland Delphi (YARA)

      • ianygo_net_4.8.1.exe (PID: 7548)
      • ianygo_net_4.8.1.tmp (PID: 4696)

    • The sample compiled with chinese language support

      • ianygo_net_4.8.1.tmp (PID: 4696)

    • Detects InnoSetup installer (YARA)

      • ianygo_net_4.8.1.tmp (PID: 4696)
      • ianygo_net_4.8.1.exe (PID: 7548)

    • The sample compiled with arabic language support

      • ianygo_net_4.8.1.tmp (PID: 4696)
      • DPInst64.exe (PID: 5404)

    • Creates a software uninstall entry

      • ianygo_net_4.8.1.tmp (PID: 4696)

    • Application launched itself

      • msedge.exe (PID: 7200)
      • msedge.exe (PID: 5200)

    • Manual execution by a user

      • msedge.exe (PID: 5200)

    • VMProtect protector has been detected

      • Tenorshare iAnyGo.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 7408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:06:06 08:00:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 1765376
InitializedDataSize: 217088
UninitializedDataSize: 2187264
EntryPoint: 0x3c4fe0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.7.11.0
ProductVersionNumber: 2.7.11.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tenorshare Co., Ltd.
FileDescription: Tenorshare iAnyGo
FileVersion: 2.7.11.0
LegalCopyright: Copyright © 2007-2023 Tenorshare Co.,Ltd.
ProductName: 20230606160015
ProductVersion: 2.7.11.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
244
Monitored processes
102
Malicious processes
11
Suspicious processes
4

Behavior graph

Click at the process to see the details
start ianygo.exe sppextcomobj.exe no specs slui.exe svchost.exe slui.exe ianygo_net_4.8.1.exe ianygo_net_4.8.1.tmp cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs tenorshare ianygo.exe msedge.exe no specs msedge.exe no specs tasklist.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs autoinstall64.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs tasklist.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs cmd.exe no specs msedge.exe no specs msedge.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs pnputil.exe tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs drvinst.exe tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs tasklist.exe no specs conhost.exe no specs mdnsresponder.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs xcopy.exe conhost.exe no specs msedge.exe no specs tasklist.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs applemobiledeviceprocess.exe no specs curl.exe certutil.exe no specs conhost.exe no specs conhost.exe no specs installanddriver.exe no specs conhost.exe no specs qtwebengineprocess.exe qtwebengineprocess.exe no specs adb.exe no specs dpinst64.exe drvinst.exe rundll32.exe no specs update.exe drvinst.exe drvinst.exe drvinst.exe wmic.exe no specs conhost.exe no specs drvinst.exe cmd.exe no specs wmic.exe no specs conhost.exe no specs conhost.exe no specs netstat.exe no specs findstr.exe no specs findstr.exe no specs adb.exe no specs ianygo.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5900 --field-trial-handle=2324,i,16964202489755449831,4243359290759661652,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tasklist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
716findstr LISTENINGC:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
732DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{e7940ac2-1f75-da4e-8bf2-f88a5b59fefd}\usbaapl64.inf" "9" "4396571eb" "00000000000001C0" "WinSta0\Default" "00000000000001E0" "208" "C:\Program Files (x86)\Tenorshare\Tenorshare iAnyGo\iTunesRepairResources\x64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
744tasklist C:\Windows\System32\tasklist.exe—Tenorshare iAnyGo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
808"C:\Program Files (x86)\Tenorshare\Tenorshare iAnyGo\curl.exe" -v -k https://integrated.tenorshare.com/api/v1/mapbox/htWrVXGEC:\Program Files (x86)\Tenorshare\Tenorshare iAnyGo\curl.exe
Tenorshare iAnyGo.exe
User:
admin
Company:
curl, https://curl.haxx.se/
Integrity Level:
HIGH
Description:
The curl executable
Exit code:
0
Version:
7.71.1
Modules
Images
c:\program files (x86)\tenorshare\tenorshare ianygo\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
832\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—curl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3712 --field-trial-handle=2324,i,16964202489755449831,4243359290759661652,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
58 007
Read events
57 906
Write events
98
Delete events
3

Modification events

(PID) Process:(5212) ianygo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tenorshare\Downloader2.5.0
Operation:writeName:GA_PC
Value:
1
(PID) Process:(5212) ianygo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GuidGuidold
Operation:writeName:guid
Value:
61C12DBA-879A-4AED-ACC8-BD10AF70495E
(PID) Process:(5212) ianygo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GuidGuidold
Operation:writeName:user_id
Value:
1001
(PID) Process:(4696) ianygo_net_4.8.1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Tenorshare\iAnyGo
Operation:writeName:Language
Value:
English
(PID) Process:(4696) ianygo_net_4.8.1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Tenorshare\iAnyGo
Operation:writeName:Lang
Value:
en
(PID) Process:(4696) ianygo_net_4.8.1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Tenorshare\iAnyGo
Operation:writeName:InstallPath
Value:
C:\Program Files (x86)\Tenorshare\Tenorshare iAnyGo
(PID) Process:(4696) ianygo_net_4.8.1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Tenorshare\iAnyGo
Operation:writeName:firstRun
Value:
true
(PID) Process:(4696) ianygo_net_4.8.1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Tenorshare\iAnyGo
Operation:writeName:Channel
Value:
VERSION_TSPPC
(PID) Process:(5212) ianygo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{Tenorshare iAnyGo}_is1
Operation:writeName:Inno Setup: Language
Value:
en
(PID) Process:(4696) ianygo_net_4.8.1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{03DA97A5-D96B-433C-9D0C-EE2C8F0C9DC9}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (u)
Executable files
1 031
Suspicious files
1 042
Text files
1 427
Unknown types
0

Dropped files

PID
Process
Filename
Type
5212ianygo.exeC:\Users\admin\AppData\Local\Temp\ianygo_net\ianygo_net_4.8.1.exe —
MD5:—
SHA256:—
5212ianygo.exeC:\Users\admin\AppData\Local\Temp\ianygo_net\ianygo_net_4.8.1.exe.dbtext
MD5:C8E337938C15D6D35F4C203365B66354
SHA256:31998C4322918A85DFEAE11472626648D8D33F303EDE44B95344024BCD9D90C7
5212ianygo.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_234E9B04AA8520A2E6CE0C38C9A1AE0Dbinary
MD5:02E561D905F7A6062937CF9E98C35C2B
SHA256:130871B403CCD20985FDA80457725E601CA0D758D0199F100DB54DC5B3E2F4FF
5212ianygo.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:EAA3CB2C351D11A723029137D980C64E
SHA256:8CDF01D2C4BFCD7FFDF26948CCE4559B940E6C1B6FC28AD497F9E6343A422293
5212ianygo.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:014D0A8FE9767A8F05570FB4D6EBDB6D
SHA256:9C5F1684F802CD826EC74748F58104D2A5B4647418B5595AF395A9A82522FF85
5212ianygo.exeC:\Users\admin\AppData\Local\Temp\ianygo_net\ianygo_net_4.8.1.exe.xmltext
MD5:3C9FDF3A4A2D4990F34196D6D1E6FF20
SHA256:79BDE1089820D9A7C35D74F1F8DFA74F1965F501579EE337F65C9E831D556208
7548ianygo_net_4.8.1.exeC:\Users\admin\AppData\Local\Temp\is-KBTQ9.tmp\ianygo_net_4.8.1.tmpexecutable
MD5:646B16B4A55D23B0FF42955A657B2844
SHA256:20A0FB68438445606A19D2A98C9A676F08D9DDB816EF1762EC3089C61E744DB3
7676find.exeC:\Users\admin\AppData\Local\Temp\findSoftRes.txttext
MD5:21438EF4B9AD4FC266B6129A2F60DE29
SHA256:13BF7B3039C63BF5A50491FA3CFD8EB4E699D1BA1436315AEF9CBE5711530354
4696ianygo_net_4.8.1.tmpC:\Program Files (x86)\Tenorshare\Tenorshare iAnyGo\is-GACDJ.tmpexecutable
MD5:E39C723924C5465A7910ED481D063FF4
SHA256:D4BD502FCCADEDCD06C7ABCDD49BF9EA0B5FEA9659E32D65A6C4AE2C30A57C8F
4696ianygo_net_4.8.1.tmpC:\Program Files (x86)\Tenorshare\Tenorshare iAnyGo\is-CLDIF.tmpexecutable
MD5:8577137790FC163F77D6D9B359CED54A
SHA256:DA7D7B365DBCFFC228B2C1FC689D0BDA4511A47EA417458DFDB592EC41BC7DA3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
457
DNS requests
165
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5212
ianygo.exe
GET
301
104.18.25.249:80
http://www.tenorshare.com/downloads/service/softwarelog.txt
unknown
—
—
whitelisted
5212
ianygo.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
whitelisted
5212
ianygo.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
—
—
whitelisted
5212
ianygo.exe
POST
200
142.250.181.238:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
5212
ianygo.exe
POST
200
142.250.181.238:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
5212
ianygo.exe
POST
200
142.250.181.238:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
5212
ianygo.exe
POST
200
142.250.181.238:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
5212
ianygo.exe
POST
200
142.250.181.238:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5212
ianygo.exe
104.18.25.249:80
www.tenorshare.com
CLOUDFLARENET
—
whitelisted
5212
ianygo.exe
104.18.25.249:443
www.tenorshare.com
CLOUDFLARENET
—
whitelisted
5212
ianygo.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5212
ianygo.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
5212
ianygo.exe
142.250.181.238:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.41.90
whitelisted
www.tenorshare.com
  • 104.18.25.249
  • 104.18.24.249
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
update.tenorshare.com
  • 104.18.25.249
  • 104.18.24.249
unknown
www.google-analytics.com
  • 142.250.181.238
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 20.198.162.78
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.3
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.1
  • 40.126.31.128
whitelisted

Threats

PID
Process
Class
Message
5212
ianygo.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
5212
ianygo.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
5212
ianygo.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5212
ianygo.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Tenorshare Google Analytics Checkin
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6652
Tenorshare iAnyGo.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6652
Tenorshare iAnyGo.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ianygo.exe