File name:

Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe

Full analysis: https://app.any.run/tasks/b7bdd870-7ca6-4cbd-bc71-a2179e3d0df2
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 25, 2020, 02:44:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
pua
lavasoft
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DFC40730E679016F5E1AE17862198906

SHA1:

F037ED06E626DBF803C52CAB0B04DC9D66C5C996

SHA256:

36B1837D89A8D936F2D79E65AB424F3BF1B07522915E07A5DD6B7A7C0CEB2B3E

SSDEEP:

98304:fG5QgrvI6QpOkvjKg0afvdCuJRy85EMijZu4:fG5bvvQIkmpa9F3VuMyZv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • GenericSetup.exe (PID: 1708)

    • Application was dropped or rewritten from another process

      • installer.exe (PID: 2928)
      • GenericSetup.exe (PID: 1708)

    • Changes settings of System certificates

      • GenericSetup.exe (PID: 1708)

    • LAVASOFT was detected

      • installer.exe (PID: 2928)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe (PID: 668)

    • Reads the Windows organization settings

      • GenericSetup.exe (PID: 1708)

    • Reads Windows owner or organization settings

      • GenericSetup.exe (PID: 1708)

    • Reads Environment values

      • GenericSetup.exe (PID: 1708)

    • Adds / modifies Windows certificates

      • GenericSetup.exe (PID: 1708)

    • Searches for installed software

      • GenericSetup.exe (PID: 1708)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:04:18 20:54:06+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 104448
InitializedDataSize: 344064
UninitializedDataSize: -
EntryPoint: 0x148d4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.3088
ProductVersionNumber: 1.2.0.3088
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 1.2.0.3088
ProductVersion: 1.2.0.3088
CompanyName: CherryPlayer_Web
FileDescription: Software Installation
InternalName: -
LegalCopyright: CherryPlayer_Web
OriginalFileName: -
ProductName: CherryPlayer_Web's Installer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start bitcoin generator hack tool (pc ios android mac) free wallet hack generator.exe #LAVASOFT installer.exe genericsetup.exe bitcoin generator hack tool (pc ios android mac) free wallet hack generator.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Users\admin\AppData\Local\Temp\Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe" C:\Users\admin\AppData\Local\Temp\Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe
explorer.exe
User:
admin
Company:
CherryPlayer_Web
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\bitcoin generator hack tool (pc ios android mac) free wallet hack generator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1708"C:\Users\admin\AppData\Local\Temp\7zSC9216A06\GenericSetup.exe" C:\Users\admin\AppData\Local\Temp\7zSC9216A06\GenericSetup.exe C:\Users\admin\AppData\Local\Temp\7zSC9216A06\GenericSetup.exe
installer.exe
User:
admin
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\7zsc9216a06\genericsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1924"C:\Users\admin\AppData\Local\Temp\Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe" C:\Users\admin\AppData\Local\Temp\Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe—explorer.exe
User:
admin
Company:
CherryPlayer_Web
Integrity Level:
MEDIUM
Description:
Software Installation
Exit code:
3221226540
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\bitcoin generator hack tool (pc ios android mac) free wallet hack generator.exe
c:\systemroot\system32\ntdll.dll
2928.\installer.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\installer.exe
Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe
User:
admin
Company:
adaware
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\7zsc9216a06\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 449
Read events
5 364
Write events
85
Delete events
0

Modification events

(PID) Process:(2928) installer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\7zSC9216A06\de\DevLib.resources.dll
(PID) Process:(2928) installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2928) installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1708) GenericSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1708) GenericSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1708) GenericSetup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1708) GenericSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
Operation:writeName:Blob
Value:
040000000100000010000000ACB694A59C17E0D791529BB19706A6E40F0000000100000014000000CE0E658AA3E847E467A147B3049191093D055E6F030000000100000014000000D4DE20D05E66FC53FE1A50882C78DB2852CAE4741D0000000100000010000000918AD43A9475F78BB5243DE886D8103C140000000100000014000000E59D5930824758CCACFA085436867B3AB5044DF062000000010000002000000016AF57A9F676B0AB126095AA5EBADEF22AB31119D644AC95CD4B93DBF3F26AEB0B0000000100000030000000440069006700690043006500720074002000420061006C00740069006D006F0072006500200052006F006F007400000009000000010000003E000000303C06082B0601050507030106082B0601050507030406082B0601050507030206082B0601050507030306082B0601050507030906082B0601050507030853000000010000006200000030603020060A2B06010401B13E01640130123010060A2B0601040182373C0101030200C0301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0301B060567810C010130123010060A2B0601040182373C0101030200C019000000010000001000000068CB42B035EA773E52EF50ECF50EC52920000000010000007B030000308203773082025FA0030201020204020000B9300D06092A864886F70D0101050500305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F74301E170D3030303531323138343630305A170D3235303531323233353930305A305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F7430820122300D06092A864886F70D01010105000382010F003082010A0282010100A304BB22AB983D57E826729AB579D429E2E1E89580B1B0E35B8E2B299A64DFA15DEDB009056DDB282ECE62A262FEB488DA12EB38EB219DC0412B01527B8877D31C8FC7BAB988B56A09E773E81140A7D1CCCA628D2DE58F0BA650D2A850C328EAF5AB25878A9A961CA967B83F0CD5F7F952132FC21BD57070F08FC012CA06CB9AE1D9CA337A77D6F8ECB9F16844424813D2C0C2A4AE5E60FEB6A605FCB4DD075902D459189863F5A563E0900C7D5DB2067AF385EAEBD403AE5E843E5FFF15ED69BCF939367275CF77524DF3C9902CB93DE5C923533F1F2498215C079929BDC63AECE76E863A6B97746333BD681831F0788D76BFFC9E8E5D2A86A74D90DC271A390203010001A3453043301D0603551D0E04160414E59D5930824758CCACFA085436867B3AB5044DF030120603551D130101FF040830060101FF020103300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100850C5D8EE46F51684205A0DDBB4F27258403BDF764FD2DD730E3A41017EBDA2929B6793F76F6191323B8100AF958A4D46170BD04616A128A17D50ABDC5BC307CD6E90C258D86404FECCCA37E38C637114FEDDD68318E4CD2B30174EEBE755E07481A7F70FF165C84C07985B805FD7FBE6511A30FC002B4F852373904D5A9317A18BFA02AF41299F7A34582E33C5EF59D9EB5C89E7C2EC8A49E4E08144B6DFD706D6B1A63BD64E61FB7CEF0F29F2EBB1BB7F250887392C2E2E3168D9A3202AB8E18DDE91011EE7E35AB90AF3E30947AD0333DA7650FF5FC8E9E62CF47442C015DBB1DB532D247D2382ED0FE81DC326A1EB5EE3CD5FCE7811D19C32442EA6339A9
Executable files
22
Suspicious files
0
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\images\bg.pngimage
MD5:9F46222F7A613223E548A5F820A8F433
SHA256:66C266C3652E9584FF2ADECA166E86C71C6819E92BF0FC03BEDD21D5EF9C17E5
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\BundleConfig.jsontext
MD5:0F3C5140CABAB53ACF9B8F76A43BC910
SHA256:E5FB77DC271B822F797C04A022149B4EC0442221D18635CF4055B7F549A3470D
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\DownloadPage.htmlhtml
MD5:055D48530C24539058CF31EAE7B36139
SHA256:8722667554141E37DA34FE294C34B4F7C55D15835AC359FAD59A30776F32C962
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\images\loader.gifimage
MD5:2B26F73D382AB69F3914A7D9FDA97B0F
SHA256:A6A0B05B1D5C52303DD3E9E2F9CDA1E688A490FBE84EA0D6E22A051AB6EFD643
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\images\cherry-player-logo.pngimage
MD5:15F948325152E7C99D900EE4DADE93EA
SHA256:C7004BF44810058E1F3ABDFD01B3881E9B945C05DD10660EEBE8C215519D4D3B
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\images\logo.pngimage
MD5:9F356CF9731F525512942204C0A6F0E3
SHA256:39C62621CBC3376595850DF2658DB2ECB64FF156C6B213A1799AD6F20D13BA14
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\images\warning48x48.pngimage
MD5:D3361CF0D689A1B34D84F483D60BA9C9
SHA256:56739925AADA73F9489F9A6B72BFAAA92892B27D20F4D221380BA3EAE17F1442
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\InstallingPage.htmlhtml
MD5:46B742D55D344D388451FFEC50600366
SHA256:3885709A6AE6AA359CC2B5DF930D97FCD25F6BF1E973EB3BFEE9A4199BA779D3
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\Resources\OfferPage.htmlhtml
MD5:53A4925B3382E7DB8472D92A67BA94F4
SHA256:19180A9E414034A059503F88E385D4C9372576E56F0222F8D3A60024DBD8A7C8
668Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exeC:\Users\admin\AppData\Local\Temp\7zSC9216A06\app.icoimage
MD5:05B7287A9F8D76F6DD5AB5F28946D2E6
SHA256:C3472A67A3A1E7EF67DC2D61B03C7F6D1497EF5A8792C61CEDBD12DB505386E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
6
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2928
installer.exe
POST
200
104.18.87.101:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
US
text
29 b
whitelisted
2928
installer.exe
POST
200
104.18.87.101:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
US
text
29 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1708
GenericSetup.exe
104.16.235.79:443
h2oapi.adaware.com
Cloudflare Inc
US
shared
2928
installer.exe
104.18.87.101:80
flow.lavasoft.com
Cloudflare Inc
US
shared
1708
GenericSetup.exe
104.18.88.101:443
flow.lavasoft.com
Cloudflare Inc
US
shared
1708
GenericSetup.exe
104.16.236.79:443
h2oapi.adaware.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
h2oapi.adaware.com
  • 104.16.235.79
  • 104.16.236.79
malicious
flow.lavasoft.com
  • 104.18.87.101
  • 104.18.88.101
whitelisted
sos.adaware.com
  • 104.16.235.79
  • 104.16.236.79
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2928
installer.exe
A Network Trojan was detected
ET MALWARE Lavasoft PUA/Adware Client Install
Process
Message
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
GenericSetup.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
GenericSetup.exe
GenericSetup.exe
Error: File not found - h2osciter:console.tis
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bitcoin Generator Hack Tool (PC iOS Android Mac) Free Wallet Hack Generator.exe