download:

/BroomSetup.exe

Full analysis: https://app.any.run/tasks/4d5a03a2-2729-4894-bfde-76406aa1cba0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 05, 2024, 00:25:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

397926927BCA55BE4A77839B1C44DE6E

SHA1:

E10F3434EF3021C399DBBA047832F02B3C898DBD

SHA256:

4F07E1095CC915B2D46EB149D1C3BE14F3F4B4BD2742517265947FD23BDCA5A7

SSDEEP:

98304:fD8Txkkxu60wIO3Fv2W+oekubm6RBUZctukdazmSsMqwDc2bISfz1:6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Creates a writable file in the system directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iolo.exe (PID: 532)

    • Actions looks like stealing of personal data

      • ioloTrayApp.exe (PID: 316)
      • iolo.exe (PID: 532)

    • Steals credentials from Web Browsers

      • iolo.exe (PID: 532)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • BroomSetup.exe (PID: 4008)
      • iolo.exe (PID: 532)
      • incinerator.exe (PID: 2128)
      • ioloTrayApp.exe (PID: 316)

    • Reads the Internet Settings

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)

    • Process drops legitimate windows executable

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Process drops SQLite DLL files

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Creates files in the driver directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Searches for installed software

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Reads security settings of Internet Explorer

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)

    • Reads settings of System Certificates

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Creates or modifies Windows services

      • nfregdrv.exe (PID: 1544)

    • Creates a software uninstall entry

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)

    • Reads Microsoft Outlook installation path

      • iolo.exe (PID: 532)

    • Reads Internet Explorer settings

      • iolo.exe (PID: 532)

    • Changes Internet Explorer settings (feature browser emulation)

      • iolo.exe (PID: 532)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3588)

  • INFO

    • Checks supported languages

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • nfregdrv.exe (PID: 1544)
      • iolo.exe (PID: 532)
      • incinerator.exe (PID: 2128)
      • ioloTrayApp.exe (PID: 316)
      • ioloTrayApp.exe (PID: 3736)
      • wmpnscfg.exe (PID: 2472)

    • Reads the computer name

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)
      • nfregdrv.exe (PID: 1544)
      • incinerator.exe (PID: 2128)
      • ioloTrayApp.exe (PID: 316)
      • ioloTrayApp.exe (PID: 3736)
      • wmpnscfg.exe (PID: 2472)

    • Checks proxy server information

      • BroomSetup.exe (PID: 4008)
      • iolo.exe (PID: 532)

    • Creates files in the program directory

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)

    • Create files in a temporary directory

      • BroomSetup.exe (PID: 4008)

    • Reads the machine GUID from the registry

      • BroomSetup.exe (PID: 4008)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)
      • ioloTrayApp.exe (PID: 316)
      • ioloTrayApp.exe (PID: 3736)

    • Creates files or folders in the user directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)
      • ioloTrayApp.exe (PID: 316)
      • regsvr32.exe (PID: 3588)
      • ioloTrayApp.exe (PID: 3736)

    • Reads Environment values

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • incinerator.exe (PID: 2128)
      • iolo.exe (PID: 532)
      • ioloTrayApp.exe (PID: 316)
      • ioloTrayApp.exe (PID: 3736)

    • Reads the software policy settings

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 1992)
      • iolo.exe (PID: 532)

    • Reads product name

      • incinerator.exe (PID: 2128)
      • iolo.exe (PID: 532)
      • ioloTrayApp.exe (PID: 316)

    • Application launched itself

      • msedge.exe (PID: 1736)
      • msedge.exe (PID: 3248)

    • Manual execution by a user

      • msedge.exe (PID: 3248)
      • wmpnscfg.exe (PID: 2472)

    • Reads the time zone

      • iolo.exe (PID: 532)
      • ioloTrayApp.exe (PID: 316)

    • Reads Microsoft Office registry keys

      • ioloTrayApp.exe (PID: 316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:01:31 19:12:04+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 3523584
InitializedDataSize: 1331200
UninitializedDataSize: -
EntryPoint: 0x35d560
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.2.5
ProductVersionNumber: 3.0.2.5
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: iolo technologies, LLC
FileDescription: 11A12794-499E-4FA0-A281-A9A9AA8B2685
FileVersion: 3.0.2.5
InternalName: -
LegalCopyright: Copyright 1998-2017 iolo technologies, LLC. All rights reserved.
LegalTrademarks: -
OriginalFileName: -
ProductName: iolo Download Manager
ProductVersion: 3.0.2.5
Comments: Copyright 1998-2017 iolo technologies, LLC. All rights reserved.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
37
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start broomsetup.exe systemmechanic_5488cb36-be62-4606-b07b-2ee938868bd1.exe no specs systemmechanic_5488cb36-be62-4606-b07b-2ee938868bd1.exe nfregdrv.exe no specs incinerator.exe no specs netsh.exe no specs msedge.exe no specs msedge.exe no specs iolo.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs iolotrayapp.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs regsvr32.exe no specs iolotrayapp.exe msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe" C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe
iolo.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
ioloTrayApp
Exit code:
0
Version:
24.3.0.57
Modules
Images
c:\program files\iolo technologies\system mechanic\iolotrayapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
376"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4248 --field-trial-handle=1388,i,7677032595140748814,6319619152387842684,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
532"C:\Program Files\iolo technologies\System Mechanic\iolo.exe"C:\Program Files\iolo technologies\System Mechanic\iolo.exe
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
System Mechanic
Version:
24.3.0.57
Modules
Images
c:\program files\iolo technologies\system mechanic\iolo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1172"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4292 --field-trial-handle=1388,i,7677032595140748814,6319619152387842684,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1236"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1388,i,7677032595140748814,6319619152387842684,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 --field-trial-handle=1324,i,4230297390725159646,6060177875557439833,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1376"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xf8,0x61adf598,0x61adf5a8,0x61adf5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1536"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1032 --field-trial-handle=1324,i,4230297390725159646,6060177875557439833,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1544"C:\Program Files\iolo technologies\System Mechanic\WPF_Driver\release\win32\nfregdrv.exe" pgfilterC:\Program Files\iolo technologies\System Mechanic\WPF_Driver\release\win32\nfregdrv.exe—SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\iolo technologies\system mechanic\wpf_driver\release\win32\nfregdrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iolo technologies\system mechanic\wpf_driver\release\win32\nfapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
1548"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1556 --field-trial-handle=1388,i,7677032595140748814,6319619152387842684,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
32 736
Read events
32 396
Write events
326
Delete events
14

Modification events

(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4008) BroomSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
114
Suspicious files
12
Text files
64
Unknown types
138

Dropped files

PID
Process
Filename
Type
4008BroomSetup.exeC:\Users\admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txttext
MD5:—
SHA256:—
4008BroomSetup.exeC:\ProgramData\iolo\logs\WSComm.logtext
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\ProgramData\iolo technologies\logs\bootstrap.logtext
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Users\admin\AppData\Local\Microsoft\ApplicationInsights\47dcca04762a106e6b55dd88274558025456a143c2b1d8c4b4388b40b1f29722\s4dncvyb.ixubinary
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\ACResources.dllexecutable
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\gpp.exeexecutable
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\defrag.dllexecutable
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\Incinerator.exeexecutable
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\Incinerator.dllexecutable
MD5:—
SHA256:—
1992SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\msalruntime_x86.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
105
DNS requests
122
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4008
BroomSetup.exe
POST
200
20.157.87.45:80
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
unknown
—
—
unknown
856
svchost.exe
HEAD
200
185.93.1.246:80
http://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
unknown
—
—
unknown
4008
BroomSetup.exe
POST
200
20.157.87.45:80
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
unknown
—
—
unknown
856
svchost.exe
GET
200
185.93.1.246:80
http://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
unknown
—
—
unknown
532
iolo.exe
HEAD
200
185.93.1.246:80
http://download.iolo.net/sm/profiles/default/profiles.dat
unknown
—
—
unknown
532
iolo.exe
HEAD
200
185.93.1.246:80
http://download.iolo.net/sm/supertuds/default/tud.dat
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4008
BroomSetup.exe
20.157.87.45:80
svc.iolo.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3092
svchost.exe
239.255.255.250:1900
—
—
—
unknown
856
svchost.exe
185.93.1.246:80
download.iolo.net
Datacamp Limited
US
unknown
1992
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
20.9.155.145:443
westus2-2.in.applicationinsights.azure.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1992
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
20.190.22.230:443
iolo.azure-api.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3248
msedge.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
svc.iolo.com
  • 20.157.87.45
unknown
download.iolo.net
  • 185.93.1.246
whitelisted
westus2-2.in.applicationinsights.azure.com
  • 20.9.155.145
unknown
iolo.azure-api.net
  • 20.190.22.230
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.iolo.com
  • 52.31.93.31
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
assets.iolo.com
  • 169.150.247.36
unknown
fonts.googleapis.com
  • 142.250.185.74
whitelisted
fonts.gstatic.com
  • 142.250.185.67
whitelisted

Threats

PID
Process
Class
Message
856
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
Process
Message
BroomSetup.exe
-> No proxy. Direct connection
BroomSetup.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
BroomSetup.exe
IsValidCommunication : Result := True.
BroomSetup.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
BroomSetup.exe
-> No proxy. Direct connection
BroomSetup.exe
IsValidCommunication : Result := True.
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Telemetry track event installation
iolo.exe
iolo.exe InitializeToolkit enter False
iolo.exe
Log enabled 0
ioloTrayApp.exe
Log enabled 0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/BroomSetup.exe