analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

mHotspot_setup_latest_2.exe

Full analysis: https://app.any.run/tasks/0c02f848-be87-4025-92f1-e4360703edca
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 27, 2019, 05:01:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
pua
lavasoft
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

67303E6191E0D251D7FBACE129E7BA62

SHA1:

1F6890B0CF4D6497C3A352E8ED033D44B8396D4A

SHA256:

4E8BC297E8BBB7F2D818B55234A82E198667AA25D2C69785D121396108A7D08C

SSDEEP:

24576:XG50ZfFK84agNXQ1g5JruMCapWPTFHic3wxqhade3e6FMoAmEkeEzFvlqOoP54jS:XG5UfgnZ5XWapKTX3phade3Fj3E6zF7Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • GenericSetup.exe (PID: 1740)
      • WebCompanionInstaller.exe (PID: 2920)
      • SpareioInstaller.exe (PID: 2068)
      • SpareioWinService.exe (PID: 876)
      • WebCompanion.exe (PID: 3524)
      • Spareio.exe (PID: 2456)
      • Spareio.exe (PID: 3884)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2228)
      • WebCompanion.exe (PID: 1648)
      • instup.exe (PID: 2460)
      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 3952)
      • AvEmUpdate.exe (PID: 2584)
      • AvEmUpdate.exe (PID: 2688)
      • avBugReport.exe (PID: 3160)
      • RegSvr.exe (PID: 184)
      • RegSvr.exe (PID: 1212)
      • aswRunDll.exe (PID: 776)
      • engsup.exe (PID: 1256)
      • engsup.exe (PID: 1688)
      • AvastSvc.exe (PID: 2624)
      • aswEngSrv.exe (PID: 2116)

    • Application was dropped or rewritten from another process

      • GenericSetup.exe (PID: 1740)
      • installer.exe (PID: 948)
      • Carrier.exe (PID: 3932)
      • wwqbmdhq.ctz.exe (PID: 1972)
      • WebCompanionInstaller.exe (PID: 2920)
      • SpareioInstaller.exe (PID: 1832)
      • c4c554lp.hmc.exe (PID: 2820)
      • SpareioInstaller.exe (PID: 2068)
      • Spareio.exe (PID: 2456)
      • Spareio.exe (PID: 3884)
      • WebCompanion.exe (PID: 3524)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2228)
      • SpareioWinService.exe (PID: 876)
      • WebCompanion.exe (PID: 1648)
      • Ad-Aware Web Companion.exe (PID: 3188)
      • 0gbxa5iq.0v3.exe (PID: 3956)
      • avast_free_antivirus_setup_online.exe (PID: 2448)
      • instup.exe (PID: 2460)
      • instup.exe (PID: 2156)
      • sbr.exe (PID: 4080)
      • SetupInf.exe (PID: 3984)
      • SetupInf.exe (PID: 3712)
      • SetupInf.exe (PID: 3936)
      • SetupInf.exe (PID: 3172)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2180)
      • mHotspot.exe (PID: 3764)
      • AvEmUpdate.exe (PID: 2584)
      • AvEmUpdate.exe (PID: 3952)
      • CCUpdate.exe (PID: 460)
      • avBugReport.exe (PID: 3160)
      • CCUpdate.exe (PID: 3664)
      • CCUpdate.exe (PID: 1524)
      • CCUpdate.exe (PID: 3812)
      • overseer.exe (PID: 2988)
      • AvastNM.exe (PID: 2428)
      • AvastSvc.exe (PID: 2624)
      • aswEngSrv.exe (PID: 2116)
      • wsc_proxy.exe (PID: 836)

    • LAVASOFT was detected

      • installer.exe (PID: 948)

    • Changes settings of System certificates

      • GenericSetup.exe (PID: 1740)
      • wwqbmdhq.ctz.exe (PID: 1972)
      • AvastSvc.exe (PID: 2624)

    • Downloads executable files from the Internet

      • GenericSetup.exe (PID: 1740)
      • 0gbxa5iq.0v3.exe (PID: 3956)
      • AvEmUpdate.exe (PID: 2688)
      • CCUpdate.exe (PID: 3664)

    • Changes internet zones settings

      • WebCompanionInstaller.exe (PID: 2920)

    • Changes the autorun value in the registry

      • Spareio.exe (PID: 2456)
      • WebCompanion.exe (PID: 3524)
      • instup.exe (PID: 2156)

    • Loads the Task Scheduler COM API

      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2688)
      • CCUpdate.exe (PID: 3664)
      • CCUpdate.exe (PID: 920)
      • overseer.exe (PID: 2988)

  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • GenericSetup.exe (PID: 1740)
      • wwqbmdhq.ctz.exe (PID: 1972)

    • Reads the Windows organization settings

      • GenericSetup.exe (PID: 1740)

    • Executable content was dropped or overwritten

      • mHotspot_setup_latest_2.exe (PID: 2408)
      • Carrier.tmp (PID: 2828)
      • Carrier.exe (PID: 3932)
      • GenericSetup.exe (PID: 1740)
      • c4c554lp.hmc.exe (PID: 2820)
      • SpareioInstaller.exe (PID: 1832)
      • wwqbmdhq.ctz.exe (PID: 1972)
      • SpareioInstaller.exe (PID: 2068)
      • WebCompanionInstaller.exe (PID: 2920)
      • instup.exe (PID: 2460)
      • 0gbxa5iq.0v3.exe (PID: 3956)
      • avast_free_antivirus_setup_online.exe (PID: 2448)
      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2688)
      • SpareioWinService.exe (PID: 876)
      • AvEmUpdate.exe (PID: 2584)
      • CCUpdate.exe (PID: 460)
      • CCUpdate.exe (PID: 3812)
      • AvastSvc.exe (PID: 2624)

    • Reads Windows owner or organization settings

      • GenericSetup.exe (PID: 1740)

    • Reads Environment values

      • GenericSetup.exe (PID: 1740)
      • SpareioInstaller.exe (PID: 2068)
      • SpareioWinService.exe (PID: 876)
      • Spareio.exe (PID: 2456)
      • Spareio.exe (PID: 3884)
      • AvastSvc.exe (PID: 2624)

    • Starts CMD.EXE for commands execution

      • GenericSetup.exe (PID: 1740)
      • WebCompanionInstaller.exe (PID: 2920)
      • SpareioWinService.exe (PID: 876)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2228)

    • Starts Internet Explorer

      • Carrier.tmp (PID: 2828)

    • Creates files in the program directory

      • SpareioInstaller.exe (PID: 2068)
      • WebCompanionInstaller.exe (PID: 2920)
      • Spareio.exe (PID: 2456)
      • WebCompanion.exe (PID: 3524)
      • SpareioWinService.exe (PID: 876)
      • WebCompanion.exe (PID: 1648)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2228)
      • instup.exe (PID: 2460)
      • avast_free_antivirus_setup_online.exe (PID: 2448)
      • AvEmUpdate.exe (PID: 2180)
      • AvEmUpdate.exe (PID: 2688)
      • CCUpdate.exe (PID: 460)
      • CCUpdate.exe (PID: 3812)
      • CCUpdate.exe (PID: 3664)
      • CCUpdate.exe (PID: 920)
      • avBugReport.exe (PID: 3160)
      • instup.exe (PID: 2156)
      • AvastNM.exe (PID: 2428)
      • dw20.exe (PID: 1464)
      • engsup.exe (PID: 1256)
      • engsup.exe (PID: 1688)
      • AvastSvc.exe (PID: 2624)
      • wsc_proxy.exe (PID: 836)

    • Starts SC.EXE for service management

      • WebCompanionInstaller.exe (PID: 2920)
      • SpareioInstaller.exe (PID: 2068)

    • Creates a software uninstall entry

      • WebCompanionInstaller.exe (PID: 2920)
      • SpareioInstaller.exe (PID: 2068)
      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2584)

    • Creates files in the user directory

      • WebCompanionInstaller.exe (PID: 2920)
      • Spareio.exe (PID: 2456)
      • SpareioWinService.exe (PID: 876)
      • Spareio.exe (PID: 3884)
      • WebCompanion.exe (PID: 3524)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 3404)
      • cmd.exe (PID: 4008)
      • cmd.exe (PID: 2148)

    • Searches for installed software

      • SpareioWinService.exe (PID: 876)
      • SpareioInstaller.exe (PID: 2068)
      • GenericSetup.exe (PID: 1740)

    • Creates files in the Windows directory

      • Lavasoft.WCAssistant.WinService.exe (PID: 2228)
      • 0gbxa5iq.0v3.exe (PID: 3956)
      • WebCompanion.exe (PID: 3524)
      • WebCompanionInstaller.exe (PID: 2920)
      • avast_free_antivirus_setup_online.exe (PID: 2448)
      • instup.exe (PID: 2460)
      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2688)
      • AvastSvc.exe (PID: 2624)

    • Reads Internet Cache Settings

      • Spareio.exe (PID: 3884)
      • instup.exe (PID: 2156)

    • Removes files from Windows directory

      • Lavasoft.WCAssistant.WinService.exe (PID: 2228)
      • WebCompanionInstaller.exe (PID: 2920)
      • instup.exe (PID: 2460)
      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2688)
      • avast_free_antivirus_setup_online.exe (PID: 2448)

    • Low-level read access rights to disk partition

      • 0gbxa5iq.0v3.exe (PID: 3956)
      • instup.exe (PID: 2460)
      • avast_free_antivirus_setup_online.exe (PID: 2448)
      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2688)
      • AvEmUpdate.exe (PID: 2584)
      • AvEmUpdate.exe (PID: 3952)
      • CCUpdate.exe (PID: 460)
      • CCUpdate.exe (PID: 3812)
      • CCUpdate.exe (PID: 1524)
      • CCUpdate.exe (PID: 920)
      • CCUpdate.exe (PID: 3664)
      • avBugReport.exe (PID: 3160)
      • overseer.exe (PID: 2988)
      • AvastSvc.exe (PID: 2624)

    • Changes the started page of IE

      • WebCompanion.exe (PID: 3524)

    • Starts itself from another location

      • instup.exe (PID: 2460)
      • CCUpdate.exe (PID: 3812)

    • Modifies the open verb of a shell class

      • instup.exe (PID: 2156)

    • Creates COM task schedule object

      • instup.exe (PID: 2156)
      • RegSvr.exe (PID: 184)
      • RegSvr.exe (PID: 1212)

    • Creates files in the driver directory

      • instup.exe (PID: 2156)
      • AvEmUpdate.exe (PID: 2688)

    • Application launched itself

      • AvEmUpdate.exe (PID: 2688)
      • CCUpdate.exe (PID: 3664)

    • Creates or modifies windows services

      • instup.exe (PID: 2156)
      • AvastSvc.exe (PID: 2624)

    • Reads the cookies of Mozilla Firefox

      • engsup.exe (PID: 1688)

    • Reads the cookies of Google Chrome

      • engsup.exe (PID: 1688)

  • INFO

    • Application was dropped or rewritten from another process

      • Carrier.tmp (PID: 2828)

    • Creates files in the program directory

      • Carrier.tmp (PID: 2828)

    • Changes internet zones settings

      • iexplore.exe (PID: 3120)

    • Loads dropped or rewritten executable

      • Carrier.tmp (PID: 2828)

    • Creates a software uninstall entry

      • Carrier.tmp (PID: 2828)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2452)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2452)
      • iexplore.exe (PID: 916)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2452)
      • iexplore.exe (PID: 916)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2452)

    • Dropped object may contain Bitcoin addresses

      • WebCompanionInstaller.exe (PID: 2920)
      • SpareioInstaller.exe (PID: 2068)
      • WebCompanion.exe (PID: 3524)
      • instup.exe (PID: 2156)

    • Reads settings of System Certificates

      • SpareioInstaller.exe (PID: 2068)
      • Spareio.exe (PID: 2456)
      • Spareio.exe (PID: 3884)
      • SpareioWinService.exe (PID: 876)

    • Creates files in the user directory

      • iexplore.exe (PID: 3120)
      • iexplore.exe (PID: 916)

    • Application launched itself

      • iexplore.exe (PID: 3120)

    • Application was crashed

      • mHotspot.exe (PID: 3764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

ProductName: mHotspot
OriginalFileName: -
LegalCopyright: -
InternalName: -
FileDescription: mHotspot Setup
CompanyName: 1BN Software & IT Solutions Pvt. Ltd.
ProductVersion: 7.8.8.9
FileVersion: 7.8.8.9
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 7.8.8.9
FileVersionNumber: 7.8.8.9
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x148d4
UninitializedDataSize: -
InitializedDataSize: 83968
CodeSize: 104448
LinkerVersion: 6
PEType: PE32
TimeStamp: 2011:04:18 20:54:06+02:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
76
Malicious processes
33
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start mhotspot_setup_latest_2.exe no specs mhotspot_setup_latest_2.exe #LAVASOFT installer.exe genericsetup.exe cmd.exe no specs carrier.exe carrier.tmp cmd.exe no specs wwqbmdhq.ctz.exe iexplore.exe iexplore.exe cmd.exe no specs c4c554lp.hmc.exe webcompanioninstaller.exe wmiapsrv.exe no specs spareioinstaller.exe spareioinstaller.exe sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs spareiowinservice.exe spareio.exe webcompanion.exe cmd.exe no specs netsh.exe no specs spareio.exe lavasoft.wcassistant.winservice.exe wmiapsrv.exe no specs cmd.exe no specs csc.exe no specs netsh.exe no specs cvtres.exe no specs csc.exe no specs cvtres.exe no specs ad-aware web companion.exe no specs webcompanion.exe cmd.exe no specs 0gbxa5iq.0v3.exe presentationfontcache.exe no specs avast_free_antivirus_setup_online.exe instup.exe instup.exe sbr.exe no specs iexplore.exe setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe mhotspot.exe dw20.exe no specs avemupdate.exe avemupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe avbugreport.exe regsvr.exe no specs regsvr.exe no specs aswrundll.exe no specs avastnm.exe no specs overseer.exe engsup.exe no specs avastsvc.exe engsup.exe no specs aswengsrv.exe no specs wsc_proxy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2592"C:\Users\admin\AppData\Local\Temp\mHotspot_setup_latest_2.exe" C:\Users\admin\AppData\Local\Temp\mHotspot_setup_latest_2.exe—explorer.exe
User:
admin
Company:
1BN Software & IT Solutions Pvt. Ltd.
Integrity Level:
MEDIUM
Description:
mHotspot Setup
Exit code:
3221226540
Version:
7.8.8.9
2408"C:\Users\admin\AppData\Local\Temp\mHotspot_setup_latest_2.exe" C:\Users\admin\AppData\Local\Temp\mHotspot_setup_latest_2.exe
explorer.exe
User:
admin
Company:
1BN Software & IT Solutions Pvt. Ltd.
Integrity Level:
HIGH
Description:
mHotspot Setup
Exit code:
0
Version:
7.8.8.9
948.\installer.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\installer.exe
mHotspot_setup_latest_2.exe
User:
admin
Company:
adaware
Integrity Level:
HIGH
Description:
mHotspot Setup
Exit code:
0
Version:
2.7.2.1576
1740C:\Users\admin\AppData\Local\Temp\7zS86999411\GenericSetup.exe C:\Users\admin\AppData\Local\Temp\7zS86999411\GenericSetup.exe
installer.exe
User:
admin
Company:
adaware
Integrity Level:
HIGH
Description:
mHotspot Setup
Exit code:
0
Version:
2.7.2.1576
3976"C:\Windows\system32\cmd.exe" /C ""C:\Users\admin\AppData\Local\Temp\7zS86999411\Carrier.exe" /VERYSILENT /DIR="C:\Program Files\mHotspot" /GROUP="mHotspot" "C:\Windows\system32\cmd.exe—GenericSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3932"C:\Users\admin\AppData\Local\Temp\7zS86999411\Carrier.exe" /VERYSILENT /DIR="C:\Program Files\mHotspot" /GROUP="mHotspot" C:\Users\admin\AppData\Local\Temp\7zS86999411\Carrier.exe
cmd.exe
User:
admin
Company:
1BN Software & IT Solutions Pvt. Ltd.
Integrity Level:
HIGH
Description:
mHotspot Setup
Exit code:
0
Version:
7.8.8.9
2828"C:\Users\admin\AppData\Local\Temp\is-F9MM5.tmp\Carrier.tmp" /SL5="$102B4,278796,56832,C:\Users\admin\AppData\Local\Temp\7zS86999411\Carrier.exe" /VERYSILENT /DIR="C:\Program Files\mHotspot" /GROUP="mHotspot" C:\Users\admin\AppData\Local\Temp\is-F9MM5.tmp\Carrier.tmp
Carrier.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
3700"C:\Windows\system32\cmd.exe" /C ""C:\Users\admin\AppData\Local\Temp\wwqbmdhq.ctz.exe" --dealId=3DG6OyV --campaignId=h200818"C:\Windows\system32\cmd.exe—GenericSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1972"C:\Users\admin\AppData\Local\Temp\wwqbmdhq.ctz.exe" --dealId=3DG6OyV --campaignId=h200818C:\Users\admin\AppData\Local\Temp\wwqbmdhq.ctz.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
XRewardSDK
Exit code:
0
Version:
1.0.0.0
3120"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Carrier.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
16 535
Read events
10 522
Write events
0
Delete events
0

Modification events

No data
Executable files
543
Suspicious files
128
Text files
673
Unknown types
62

Dropped files

PID
Process
Filename
Type
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\GenericSetup.exeexecutable
MD5:93DD8ED10D8A096255C73F93F8A5893B
SHA256:52E054CF6079584A875A63C6DA060EF31ED1ACCF5E596B7833F6D692D597E28C
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\it\DevLib.resources.dllexecutable
MD5:CFE49BBD64B4EE1793D9DBED4FEF3470
SHA256:10DD3F30A8A527B63D83DF450EAED7FD8B9B5619CB07D5CD448F9D0A7B64B2F8
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\en\DevLib.resources.dllexecutable
MD5:1DDE7D32EB87B5EAC33BE5BD2930270F
SHA256:3B3216E27F5813CAC1AAA7F901E16E354624B91355B982D4C0BBD4ECCC32CCF5
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\DevLib.dllexecutable
MD5:A0D1EB07731F50059040D1868E42E3DC
SHA256:2C010964509765586BB036034E0A0B63FD561EF3CA24328B0F6E3AAD39F9D03C
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\pt\DevLib.resources.dllexecutable
MD5:ACAE5D9AD6659EF4E7A37D86E03CB679
SHA256:3CB89DB8C8F861E956971D0C3E836DEEDCDC1DEA069C9C15644D7E2354A84C05
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:DD7F40BFA1B5D88C1B95A896ADE39909
SHA256:6D3AB13D023628F12B8DFDAE5137131048CDD80CA1B8ED40C90C7CA6B6530C63
1740GenericSetup.exeC:\Users\admin\AppData\Local\Temp\mHotspot.logtext
MD5:CBB004057726BF047B562E42436C6FBB
SHA256:6AA3D76BAF7ACD2E2FE0EAA640AA9EA8CB6BC0C56B13BD321D92AFA7F49826FE
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\es\DevLib.resources.dllexecutable
MD5:6A8E6344DFD017C9D6361A8C84DEB383
SHA256:9B09255026A9DC5556E0CA8EB7631E354E093FF72A2460B2FBBDF565F38E9D57
2408mHotspot_setup_latest_2.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\ru\DevLib.resources.dllexecutable
MD5:CA2507B3CC8E898B4FD8C0483457E9DC
SHA256:FF8AE806A00CD50B17252B40E36C01968874B34D0FE37058BAD396DA97340998
948installer.exeC:\Users\admin\AppData\Local\Temp\7zS86999411\GenericSetup.exe.configxml
MD5:84DE2583B776B336964D80697D3352BF
SHA256:39F8D720A6AC4722A62681EBA0BBFE7CC5E04DD676ECC0F10001185CF22D832B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
192
TCP/UDP connections
173
DNS requests
145
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1740
GenericSetup.exe
GET
200
104.17.178.102:80
http://rt.webcompanion.com/notifications/download/rt/Installer/SpareioSDK.exe
US
executable
44.6 Kb
malicious
1972
wwqbmdhq.ctz.exe
GET
200
8.248.131.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.6 Kb
whitelisted
2920
WebCompanionInstaller.exe
POST
200
64.18.87.81:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
1972
wwqbmdhq.ctz.exe
GET
200
8.248.131.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/8CF427FD790C3AD166068DE81E57EFBB932272D4.crt
US
der
1.06 Kb
whitelisted
948
installer.exe
POST
200
104.17.61.19:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
US
text
29 b
whitelisted
2452
iexplore.exe
GET
301
68.183.82.64:80
http://mhotspot.com/scripts/go_thankyou.html
US
html
331 b
malicious
2920
WebCompanionInstaller.exe
POST
200
64.18.87.81:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
2920
WebCompanionInstaller.exe
POST
200
64.18.87.81:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
2920
WebCompanionInstaller.exe
POST
200
64.18.87.81:80
http://wc-tracking.lavasoft.com/Install.asmx
CA
xml
294 b
whitelisted
1740
GenericSetup.exe
GET
200
104.17.177.102:80
http://webcompanion.com/nano_download.php?partner=MH170601
US
executable
347 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
948
installer.exe
104.17.61.19:80
flow.lavasoft.com
Cloudflare Inc
US
shared
2920
WebCompanionInstaller.exe
64.18.87.82:80
wc-tracking.lavasoft.com
COGECODATA
CA
unknown
1740
GenericSetup.exe
104.17.60.19:443
flow.lavasoft.com
Cloudflare Inc
US
shared
1740
GenericSetup.exe
104.16.236.79:443
sos.adaware.com
Cloudflare Inc
US
shared
3120
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2452
iexplore.exe
68.183.82.64:443
mhotspot.com
DSL Extreme
US
unknown
2920
WebCompanionInstaller.exe
64.18.87.81:80
wc-tracking.lavasoft.com
COGECODATA
CA
unknown
1740
GenericSetup.exe
104.17.178.102:80
webcompanion.com
Cloudflare Inc
US
shared
1972
wwqbmdhq.ctz.exe
35.227.19.75:80
api.spare.io
—
US
unknown
2920
WebCompanionInstaller.exe
104.17.61.19:80
flow.lavasoft.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
flow.lavasoft.com
  • 104.17.61.19
  • 104.17.60.19
whitelisted
www.google.com
  • 172.217.21.196
whitelisted
sos.adaware.com
  • 104.16.236.79
  • 104.16.235.79
whitelisted
webcompanion.com
  • 104.17.177.102
  • 104.17.178.102
malicious
rt.webcompanion.com
  • 104.17.178.102
  • 104.17.177.102
malicious
www.download.windowsupdate.com
  • 8.248.131.254
  • 67.27.157.254
  • 67.27.235.254
  • 8.248.117.254
  • 67.27.233.254
whitelisted
mhotspot.com
  • 68.183.82.64
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
wc-tracking.lavasoft.com
  • 64.18.87.81
  • 64.18.87.82
whitelisted
wc-update-service.lavasoft.com
  • 64.18.87.82
  • 64.18.87.81
whitelisted

Threats

PID
Process
Class
Message
948
installer.exe
A Network Trojan was detected
ET MALWARE Lavasoft PUA/Adware Client Install
1740
GenericSetup.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
1740
GenericSetup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1740
GenericSetup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1740
GenericSetup.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1740
GenericSetup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1740
GenericSetup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3956
0gbxa5iq.0v3.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3956
0gbxa5iq.0v3.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
2156
instup.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
wwqbmdhq.ctz.exe
Register
WebCompanionInstaller.exe
Detecting windows culture
wwqbmdhq.ctz.exe
Machine ID fingerPrint -- > CPU >> 1F8BFBFF000506E3 BIOS >> DELLDELL20110101000000.000000+000DELL - 1 BASE >> DISK >> WDC WD20EARS ATA Device(Standard disk drives)1660034144255 VIDEO >> 6.1.7600.16385Standard VGA Graphics Adapter MAC >> 52:54:00:4A:04:AF WCID >> WCID20
wwqbmdhq.ctz.exe
Machine ID hash UUID -- > 735550BB-0FAF-AAB3-C4F6-BBAC563DACB9
wwqbmdhq.ctz.exe
Getting SysInfo
wwqbmdhq.ctz.exe
cpuInfo
WebCompanionInstaller.exe
4/27/2019 6:02:46 AM :-> Starting installer 4.6.1974.3869 with: .\WebCompanionInstaller.exe --partner=MH170601 --version=4.6.1974.3869 --prod --silent --homepage=1 --search=1 --partner=MH170601, Run as admin: True
WebCompanionInstaller.exe
Preparing for installing Web Companion
wwqbmdhq.ctz.exe
gpuInfo
wwqbmdhq.ctz.exe
uptimePct
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
mHotspot_setup_latest_2.exe