URL:

http://download.visualware.com/pub/vr/vrle.exe

Full analysis: https://app.any.run/tasks/ac7914cb-4d1d-4150-afd3-2b575622bb9a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 26, 2019, 05:54:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
Indicators:
MD5:

48A6190E571F0BE5245CA897C5433C20

SHA1:

0ACE71E63B663F0C28B73A0F77AB575C3CD55BF3

SHA256:

32215E3D4DE612C82945C4A8B1B2FF581CD4B4C89AB0A8BECC785537D3F18463

SSDEEP:

3:N1KaKElAUJSEXAZlQHI6OJn:Ca5Vc/QHI6OJn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • opera.exe (PID: 2836)

    • Application was dropped or rewritten from another process

      • vrle.exe (PID: 3180)
      • vrle.exe (PID: 2608)
      • VisualRoute.exe (PID: 1472)
      • MakeLink.exe (PID: 2700)
      • VisualRoute.exe (PID: 3908)

    • Loads dropped or rewritten executable

      • java.exe (PID: 1928)
      • java.exe (PID: 3928)
      • java.exe (PID: 616)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • opera.exe (PID: 2836)
      • java.exe (PID: 1928)
      • java.exe (PID: 2648)
      • java.exe (PID: 2272)
      • java.exe (PID: 616)

    • Creates files in the program directory

      • MakeLink.exe (PID: 2700)
      • java.exe (PID: 1928)

    • Creates a software uninstall entry

      • java.exe (PID: 1928)

    • Starts Internet Explorer

      • java.exe (PID: 616)

    • Uses IPCONFIG.EXE to discover IP address

      • java.exe (PID: 616)

  • INFO

    • Creates files in the user directory

      • opera.exe (PID: 2836)
      • iexplore.exe (PID: 3300)

    • Manual execution by user

      • vrle.exe (PID: 2608)
      • vrle.exe (PID: 3180)

    • Dropped object may contain Bitcoin addresses

      • java.exe (PID: 1928)
      • java.exe (PID: 616)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3300)

    • Application launched itself

      • iexplore.exe (PID: 4048)

    • Changes internet zones settings

      • iexplore.exe (PID: 4048)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4048)
      • iexplore.exe (PID: 3300)
      • opera.exe (PID: 2836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
14
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start opera.exe vrle.exe no specs vrle.exe java.exe makelink.exe no specs visualroute.exe no specs java.exe java.exe no specs visualroute.exe no specs java.exe java.exe ipconfig.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
616java -mx256m jexepackboot R "C:\Program Files\VisualRoute Lite Edition\VisualRoute.exe" "C:\Users\admin\AppData\Local\Temp\X4ABF44" C:\ProgramData\Oracle\Java\javapath\java.exe
VisualRoute.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1472"C:\Program Files\VisualRoute Lite Edition\VisualRoute.exe" -Q* /installC:\Program Files\VisualRoute Lite Edition\VisualRoute.exe—java.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\visualroute lite edition\visualroute.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1928java -mx256m jexepackboot ER "C:\Users\admin\Desktop\vrle.exe" "C:\Users\admin\AppData\Local\Temp\X4A3C6C" C:\ProgramData\Oracle\Java\javapath\java.exe
vrle.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2272java -mx256m jexepackboot E "C:\Program Files\VisualRoute Lite Edition\VisualRoute.exe" "C:\Users\admin\AppData\Local\Temp\X4ABF44" C:\ProgramData\Oracle\Java\javapath\java.exe
VisualRoute.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
12345
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2608"C:\Users\admin\Desktop\vrle.exe" C:\Users\admin\Desktop\vrle.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\vrle.exe
c:\systemroot\system32\ntdll.dll
2648java -mx256m jexepackboot E "C:\Program Files\VisualRoute Lite Edition\VisualRoute.exe" "C:\Users\admin\AppData\Local\Temp\X4A85C0" /installC:\ProgramData\Oracle\Java\javapath\java.exe
VisualRoute.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
12345
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2700"C:\Users\admin\AppData\Local\Temp\X4A3C6C\MakeLink" C:\Users\admin\AppData\Local\Temp\X4A3C6C\makelinks.txtC:\Users\admin\AppData\Local\Temp\X4A3C6C\MakeLink.exe—java.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\x4a3c6c\makelink.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2836"C:\Program Files\Opera\opera.exe" "http://download.visualware.com/pub/vr/vrle.exe"C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
3016ipconfig.exe /allC:\Windows\system32\ipconfig.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3180"C:\Users\admin\Desktop\vrle.exe" C:\Users\admin\Desktop\vrle.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vrle.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 333
Read events
1 139
Write events
190
Delete events
4

Modification events

(PID) Process:(2836) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "http://download.visualware.com/pub/vr/vrle.exe"
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
02000000070000000100000009000000080000000000000006000000030000000500000004000000FFFFFFFF
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2836) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:FFlags
Value:
1092616257
Executable files
28
Suspicious files
67
Text files
526
Unknown types
187

Dropped files

PID
Process
Filename
Type
2836opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr5495.tmp —
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr54A6.tmp —
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr54F5.tmp —
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp —
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7XEZ72AABZP449CVT3BD.temp —
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-ms~RF11602e.TMPbinary
MD5:—
SHA256:—
2836opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-msbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
108
DNS requests
42
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
616
java.exe
GET
400
38.100.141.75:80
http://secure.visualware.com./crm/LiveUpdate?q=TxiQVzV3NqaIlf0KtW41BVRa133wEKQMzkjjfQdERzp1S9MpZEXVPUdUsu613LyHwqUQtNnGDGavbgB1iqjZgNz7tPPMuYYDtk1YsD2VhSG5MK5QZYK3RJ71xxntgict4H
US
—
—
suspicious
616
java.exe
GET
200
38.100.141.80:80
http://www.visualroute.com/clientconfig/fixedagents14.bin
US
binary
128 b
malicious
2836
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
528 b
whitelisted
2836
opera.exe
GET
200
38.96.140.83:80
http://download.visualware.com/pub/vr/vrle.exe
US
executable
5.30 Mb
suspicious
616
java.exe
GET
200
38.100.141.80:80
http://www.visualroute.com/updates/updates.txt
US
text
86 b
malicious
616
java.exe
GET
200
38.100.141.110:80
http://update.visualware.com/hotlinks/Hotlinks?p=VR&e=100&b=7906&v=140100&i=0&o=W&t=F&j=o-1.8.0_92
US
html
145 b
suspicious
616
java.exe
GET
200
38.100.141.80:80
http://www.visualroute.com/clientconfig/languagesv11.txt
US
text
980 b
malicious
3300
iexplore.exe
GET
200
38.100.141.80:80
http://www.visualroute.com/purchase/vr11upgrades/vr11upgrade.html?cv=100&tv=1&ft=Route%20map&tr=0
US
html
2.64 Kb
malicious
3300
iexplore.exe
GET
200
38.100.141.80:80
http://www.visualroute.com/gcss/styles_mcs2.css
US
text
8.55 Kb
malicious
3300
iexplore.exe
GET
200
38.100.141.80:80
http://www.visualroute.com/favicon.ico
US
image
2.19 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4048
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2836
opera.exe
38.96.140.83:80
download.visualware.com
Cogent Communications
US
suspicious
2836
opera.exe
185.26.182.111:80
sitecheck2.opera.com
Opera Software AS
—
whitelisted
2836
opera.exe
185.26.182.94:443
sitecheck2.opera.com
Opera Software AS
—
whitelisted
2836
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
616
java.exe
38.100.141.80:80
www.visualroute.com
Cogent Communications
US
malicious
616
java.exe
38.100.141.110:80
update.visualware.com
Cogent Communications
US
suspicious
616
java.exe
38.100.141.76:80
www.visualware.com
Cogent Communications
US
suspicious
616
java.exe
38.100.141.75:80
secure.visualware.com
Cogent Communications
US
unknown
616
java.exe
193.0.6.135:43
whois.ripe.net
Reseaux IP Europeens Network Coordination Centre (RIPE NCC)
NL
unknown

DNS requests

Domain
IP
Reputation
download.visualware.com
  • 38.96.140.83
suspicious
sitecheck2.opera.com
  • 185.26.182.111
  • 185.26.182.112
  • 185.26.182.93
  • 185.26.182.94
whitelisted
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
www.visualroute.com
  • 38.100.141.80
malicious
update.visualware.com
  • 38.100.141.110
suspicious
www.visualware.com
  • 38.100.141.76
  • 38.100.141.80
malicious
secure.visualware.com
  • 38.100.141.75
suspicious
TxiQVzV3NqaIlf0KtW41BVRa133wEKQMzkjjfQdERzp.1S9MpZEXVPUdUsu613LyHwqUQtNnGDGavbgB1iqjZgN.z7tPPMuYYDtk1YsD2VhSG5MK5QZYK3RJ71xxntgict4H.LiveUpdate.crm.visualware.com
  • 93.140.109.0
unknown
www.onet.pl
  • 213.180.141.140
whitelisted

Threats

PID
Process
Class
Message
2836
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.visualware.com/pub/vr/vrle.exe