URL:

https://package.avira.com/download/spotlight-windows-bootstrapper/avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe

Full analysis: https://app.any.run/tasks/70d91ec1-8e31-47a7-8dc1-864998d4b9bd
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: September 10, 2021, 04:26:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
azorult
stealer
raccoon
fareit
pony
loader
Indicators:
MD5:

AEFE99111A915A6D9DE47DA94D6DF378

SHA1:

83814F3F417D7A70FA42D0BFD39FA98A1D0EE47E

SHA256:

57F1104265E7E1421F81D573999E22D950D13B04CA5343ABEFA0E33D15C94A90

SSDEEP:

3:N8AZEXXiKK8LZU/3CNxExxSvUfADjwQ2y3VKJMCUCrAC:2AZSXiKO3CNxEeXMQ24UJMlC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)
      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2444)
      • Setup.exe (PID: 2076)
      • SetupUtility.exe (PID: 3708)
      • SetupUtility.exe (PID: 2984)
      • ndp48-web.exe (PID: 3224)
      • ServiceModelReg.exe (PID: 1116)
      • regtlibv12.exe (PID: 3292)
      • regtlibv12.exe (PID: 2544)
      • regtlibv12.exe (PID: 2468)
      • regtlibv12.exe (PID: 3344)
      • regtlibv12.exe (PID: 2336)
      • regtlibv12.exe (PID: 3424)
      • regtlibv12.exe (PID: 3620)
      • aspnet_regiis.exe (PID: 3416)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • keygen-pr.exe (PID: 3972)
      • keygen-step-1.exe (PID: 2980)
      • keygen-step-3.exe (PID: 2772)
      • keygen-step-3.exe (PID: 3944)
      • keygen-step-6.exe (PID: 3104)
      • keygen-step-3.exe (PID: 1388)
      • keygen-step-4.exe (PID: 308)
      • key.exe (PID: 3832)
      • key.exe (PID: 2928)
      • KiffAppE2.exe (PID: 1696)
      • Crack.exe (PID: 1256)
      • Crack.exe (PID: 620)
      • PBrowFile28.exe (PID: 3768)
      • 2CEA.tmp.exe (PID: 1600)
      • 36DE.tmp.exe (PID: 2936)
      • 378B.tmp.exe (PID: 1704)

    • Uses Task Scheduler to run other applications

      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)

    • Drops executable file immediately after starts

      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)
      • ndp48-web.exe (PID: 3224)
      • keygen-pr.exe (PID: 3972)
      • keygen-step-4.exe (PID: 308)
      • PBrowFile28.exe (PID: 3768)
      • 378B.tmp.exe (PID: 1704)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2248)

    • Changes settings of System certificates

      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • Setup.exe (PID: 2076)
      • 2CEA.tmp.exe (PID: 1600)

    • Actions looks like stealing of personal data

      • ndp48-web.exe (PID: 3224)
      • key.exe (PID: 2928)
      • 2CEA.tmp.exe (PID: 1600)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2076)
      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 2168)
      • msiexec.exe (PID: 3400)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • svchost.exe (PID: 772)
      • aspnet_regiis.exe (PID: 3416)
      • KiffAppE2.exe (PID: 1696)
      • PBrowFile28.exe (PID: 3768)
      • 36DE.tmp.exe (PID: 2936)
      • WerFault.exe (PID: 2436)
      • rundll32.exe (PID: 2212)
      • 2CEA.tmp.exe (PID: 1600)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3400)

    • Stealing of credential data

      • keygen-step-3.exe (PID: 2772)
      • 2CEA.tmp.exe (PID: 1600)

    • AZORULT was detected

      • keygen-step-1.exe (PID: 2980)

    • Connects to CnC server

      • keygen-step-1.exe (PID: 2980)
      • keygen-step-3.exe (PID: 2772)
      • 2CEA.tmp.exe (PID: 1600)
      • key.exe (PID: 2928)

    • Steals credentials from Web Browsers

      • key.exe (PID: 2928)
      • 2CEA.tmp.exe (PID: 1600)

    • Writes to a start menu file

      • 378B.tmp.exe (PID: 1704)

    • Detected Pony/Fareit Trojan

      • key.exe (PID: 2928)

    • RACCOON was detected

      • 2CEA.tmp.exe (PID: 1600)

    • PONY was detected

      • key.exe (PID: 2928)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3676)
      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • ndp48-web.exe (PID: 3224)
      • WinRAR.exe (PID: 3128)
      • TMP5EF1.tmp.exe (PID: 1404)
      • Setup.exe (PID: 2076)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • msiexec.exe (PID: 3400)
      • keygen-pr.exe (PID: 3972)
      • keygen-step-4.exe (PID: 308)
      • PBrowFile28.exe (PID: 3768)
      • keygen-step-6.exe (PID: 3104)
      • Crack.exe (PID: 1256)
      • 2CEA.tmp.exe (PID: 1600)
      • 378B.tmp.exe (PID: 1704)

    • Drops a file that was compiled in debug mode

      • chrome.exe (PID: 3676)
      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • WinRAR.exe (PID: 3128)
      • ndp48-web.exe (PID: 3224)
      • msiexec.exe (PID: 3400)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • keygen-step-4.exe (PID: 308)
      • keygen-step-6.exe (PID: 3104)
      • 2CEA.tmp.exe (PID: 1600)

    • Checks supported languages

      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • ndp48-web.exe (PID: 3224)
      • Setup.exe (PID: 2076)
      • SetupUtility.exe (PID: 3708)
      • SetupUtility.exe (PID: 2984)
      • WinRAR.exe (PID: 2420)
      • WinRAR.exe (PID: 3128)
      • TMP5EF1.tmp.exe (PID: 1404)
      • ServiceModelReg.exe (PID: 1116)
      • regtlibv12.exe (PID: 3292)
      • regtlibv12.exe (PID: 2544)
      • regtlibv12.exe (PID: 2468)
      • regtlibv12.exe (PID: 3344)
      • regtlibv12.exe (PID: 2336)
      • regtlibv12.exe (PID: 3424)
      • regtlibv12.exe (PID: 3620)
      • mofcomp.exe (PID: 2648)
      • aspnet_regiis.exe (PID: 3416)
      • mofcomp.exe (PID: 3056)
      • mofcomp.exe (PID: 2068)
      • cmd.exe (PID: 704)
      • keygen-pr.exe (PID: 3972)
      • keygen-step-1.exe (PID: 2980)
      • keygen-step-6.exe (PID: 3104)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • key.exe (PID: 2928)
      • keygen-step-3.exe (PID: 2772)
      • keygen-step-4.exe (PID: 308)
      • key.exe (PID: 3832)
      • KiffAppE2.exe (PID: 1696)
      • PBrowFile28.exe (PID: 3768)
      • Crack.exe (PID: 620)
      • Crack.exe (PID: 1256)
      • 2CEA.tmp.exe (PID: 1600)
      • 36DE.tmp.exe (PID: 2936)
      • cmd.exe (PID: 2996)
      • 378B.tmp.exe (PID: 1704)
      • cmd.exe (PID: 1408)

    • Reads the computer name

      • avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe (PID: 2892)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • ndp48-web.exe (PID: 3224)
      • Setup.exe (PID: 2076)
      • SetupUtility.exe (PID: 3708)
      • SetupUtility.exe (PID: 2984)
      • WinRAR.exe (PID: 2420)
      • WinRAR.exe (PID: 3128)
      • TMP5EF1.tmp.exe (PID: 1404)
      • ServiceModelReg.exe (PID: 1116)
      • mofcomp.exe (PID: 2648)
      • mofcomp.exe (PID: 2068)
      • mofcomp.exe (PID: 3056)
      • aspnet_regiis.exe (PID: 3416)
      • keygen-step-1.exe (PID: 2980)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • keygen-step-6.exe (PID: 3104)
      • cmd.exe (PID: 704)
      • keygen-step-3.exe (PID: 2772)
      • keygen-step-4.exe (PID: 308)
      • keygen-pr.exe (PID: 3972)
      • key.exe (PID: 3832)
      • KiffAppE2.exe (PID: 1696)
      • Crack.exe (PID: 620)
      • key.exe (PID: 2928)
      • Crack.exe (PID: 1256)
      • PBrowFile28.exe (PID: 3768)
      • 2CEA.tmp.exe (PID: 1600)
      • 36DE.tmp.exe (PID: 2936)

    • Reads Environment values

      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • Setup.exe (PID: 2076)
      • keygen-step-1.exe (PID: 2980)
      • key.exe (PID: 3832)
      • KiffAppE2.exe (PID: 1696)
      • 2CEA.tmp.exe (PID: 1600)

    • Adds / modifies Windows certificates

      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • 2CEA.tmp.exe (PID: 1600)

    • Reads CPU info

      • Setup.exe (PID: 2076)

    • Creates files in the Windows directory

      • Setup.exe (PID: 2076)
      • msiexec.exe (PID: 3400)
      • lodctr.exe (PID: 1888)
      • aspnet_regiis.exe (PID: 3416)

    • Executed as Windows Service

      • msiexec.exe (PID: 3400)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3400)
      • key.exe (PID: 3832)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3400)
      • key.exe (PID: 3832)

    • Application launched itself

      • msiexec.exe (PID: 3400)
      • key.exe (PID: 2928)
      • Crack.exe (PID: 620)

    • Drops a file with too old compile date

      • msiexec.exe (PID: 3400)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • keygen-step-4.exe (PID: 308)
      • 2CEA.tmp.exe (PID: 1600)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3400)

    • Searches for installed software

      • msiexec.exe (PID: 3400)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • 2CEA.tmp.exe (PID: 1600)
      • key.exe (PID: 2928)
      • key.exe (PID: 3832)

    • Checks for the .NET to be installed

      • msiexec.exe (PID: 3400)

    • Removes files from Windows directory

      • msiexec.exe (PID: 3400)
      • lodctr.exe (PID: 1888)
      • aspnet_regiis.exe (PID: 3416)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3400)
      • aspnet_regiis.exe (PID: 3416)

    • Drops a file with a compile date too recent

      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • keygen-step-4.exe (PID: 308)
      • Crack.exe (PID: 1256)
      • keygen-step-6.exe (PID: 3104)
      • 378B.tmp.exe (PID: 1704)
      • 2CEA.tmp.exe (PID: 1600)

    • Starts CMD.EXE for commands execution

      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)
      • keygen-step-6.exe (PID: 3104)
      • 2CEA.tmp.exe (PID: 1600)

    • Reads Windows Product ID

      • key.exe (PID: 3832)

    • Creates files in the user directory

      • keygen-step-6.exe (PID: 3104)
      • key.exe (PID: 2928)
      • 378B.tmp.exe (PID: 1704)

    • Checks for external IP

      • keygen-step-6.exe (PID: 3104)

    • Loads DLL from Mozilla Firefox

      • key.exe (PID: 2928)

    • Executed via WMI

      • rundll32.exe (PID: 2212)

    • Starts CMD.EXE for self-deleting

      • keygen-step-6.exe (PID: 3104)
      • 2CEA.tmp.exe (PID: 1600)

    • Reads the cookies of Mozilla Firefox

      • 2CEA.tmp.exe (PID: 1600)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 1748)
      • chrome.exe (PID: 2676)
      • chrome.exe (PID: 3676)
      • chrome.exe (PID: 2092)
      • chrome.exe (PID: 3612)
      • chrome.exe (PID: 2084)
      • chrome.exe (PID: 1136)
      • chrome.exe (PID: 1692)
      • chrome.exe (PID: 2928)
      • chrome.exe (PID: 1116)
      • chrome.exe (PID: 2504)
      • chrome.exe (PID: 3508)
      • chrome.exe (PID: 3516)
      • schtasks.exe (PID: 2248)
      • chrome.exe (PID: 868)
      • WISPTIS.EXE (PID: 780)
      • chrome.exe (PID: 768)
      • chrome.exe (PID: 2556)
      • chrome.exe (PID: 2476)
      • chrome.exe (PID: 2168)
      • chrome.exe (PID: 2928)
      • chrome.exe (PID: 3416)
      • chrome.exe (PID: 3072)
      • chrome.exe (PID: 3440)
      • msiexec.exe (PID: 3400)
      • MsiExec.exe (PID: 3204)
      • MsiExec.exe (PID: 2168)
      • taskmgr.exe (PID: 1788)
      • wevtutil.exe (PID: 2944)
      • wevtutil.exe (PID: 2304)
      • lodctr.exe (PID: 1888)
      • WerFault.exe (PID: 2436)
      • rundll32.exe (PID: 2212)
      • PING.EXE (PID: 1844)
      • timeout.exe (PID: 3216)

    • Reads the computer name

      • chrome.exe (PID: 2092)
      • chrome.exe (PID: 3676)
      • chrome.exe (PID: 2084)
      • chrome.exe (PID: 2676)
      • chrome.exe (PID: 2504)
      • schtasks.exe (PID: 2248)
      • WISPTIS.EXE (PID: 780)
      • chrome.exe (PID: 868)
      • chrome.exe (PID: 768)
      • chrome.exe (PID: 2168)
      • chrome.exe (PID: 3416)
      • chrome.exe (PID: 2928)
      • msiexec.exe (PID: 3400)
      • MsiExec.exe (PID: 2168)
      • taskmgr.exe (PID: 1788)
      • wevtutil.exe (PID: 2944)
      • wevtutil.exe (PID: 2304)
      • lodctr.exe (PID: 1888)
      • MsiExec.exe (PID: 3204)
      • WerFault.exe (PID: 2436)
      • rundll32.exe (PID: 2212)
      • PING.EXE (PID: 1844)

    • Reads the hosts file

      • chrome.exe (PID: 2084)
      • chrome.exe (PID: 3676)

    • Application launched itself

      • chrome.exe (PID: 3676)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2084)
      • chrome.exe (PID: 3676)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • Setup.exe (PID: 2076)
      • msiexec.exe (PID: 3400)
      • keygen-step-6.exe (PID: 3104)
      • KiffAppE2.exe (PID: 1696)
      • Crack.exe (PID: 1256)
      • 2CEA.tmp.exe (PID: 1600)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 3676)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3852)
      • Setup.exe (PID: 2076)
      • msiexec.exe (PID: 3400)
      • keygen-step-6.exe (PID: 3104)

    • Dropped object may contain Bitcoin addresses

      • svchost.exe (PID: 772)
      • Setup.exe (PID: 2076)
      • msiexec.exe (PID: 3400)

    • Reads the date of Windows installation

      • chrome.exe (PID: 2168)

    • Manual execution by user

      • WinRAR.exe (PID: 3128)
      • taskmgr.exe (PID: 1788)
      • Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe (PID: 2956)

    • Creates or modifies windows services

      • msiexec.exe (PID: 3400)

    • Reads Microsoft Office registry keys

      • key.exe (PID: 3832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
79
Malicious processes
26
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe no specs avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe schtasks.exe no specs avira.spotlight.bootstrapper.exe wisptis.exe no specs wisptis.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ndp48-web.exe setup.exe setuputility.exe no specs setuputility.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs winrar.exe tmp5ef1.tmp.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs taskmgr.exe no specs servicemodelreg.exe no specs wevtutil.exe no specs wevtutil.exe no specs svchost.exe no specs lodctr.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs mofcomp.exe no specs mofcomp.exe no specs aspnet_regiis.exe no specs mofcomp.exe no specs diskinternal.word.recovery.1.9.keygen.by.lz0.exe cmd.exe no specs #AZORULT keygen-step-1.exe keygen-pr.exe keygen-step-6.exe keygen-step-3.exe no specs keygen-step-3.exe no specs #PONY key.exe keygen-step-3.exe keygen-step-4.exe kiffappe2.exe key.exe no specs crack.exe no specs crack.exe pbrowfile28.exe #RACCOON 2cea.tmp.exe werfault.exe no specs rundll32.exe no specs 36de.tmp.exe no specs 378b.tmp.exe cmd.exe no specs ping.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308keygen-step-4.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
620"C:\Users\admin\AppData\Local\Temp\RarSFX2\Crack.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\Crack.exe—keygen-step-4.exe
User:
admin
Company:
Scooter Software
Integrity Level:
MEDIUM
Description:
Beyond Compare
Exit code:
0
Version:
4.3.4.24657
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
704C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\system32\cmd.exe—Diskinternal.word.recovery.1.9.keygen.by.Lz0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,6315607697133519187,6082849691408210395,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
772C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
780"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Avira.Spotlight.Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
24
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,6315607697133519187,6082849691408210395,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1044"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Avira.Spotlight.Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
1116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1028,6315607697133519187,6082849691408210395,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2988 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1116"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe" -msi -ia -vC:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WCF Generic Command for Vista Setup
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\servicemodelreg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
Total events
124 714
Read events
110 609
Write events
12 362
Delete events
1 743

Modification events

(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3676) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
(PID) Process:(3676) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
Executable files
2 536
Suspicious files
111
Text files
528
Unknown types
29

Dropped files

PID
Process
Filename
Type
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-613ADE7B-E5C.pma —
MD5:—
SHA256:—
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f577e92f-49b3-4973-9278-c9cc97f99bd0.tmptext
MD5:—
SHA256:—
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:—
SHA256:—
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RFfe4d9.TMPtext
MD5:81F483F77EE490F35306A4F94DB2286B
SHA256:82434CE3C9D13F509EBEEBE3A7A1A1DE9AB4557629D9FC855761E0CFA45E8BCE
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.oldtext
MD5:5202CA4D6AF0C37DAEC0D528CC7F2986
SHA256:8F5B8FF94B14C36EA0CBE8FA0A4D165A632B45F834BBB7239E1A6CF6685F256C
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:7721CDA9F5B73CE8A135471EB53B4E0E
SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500
3676chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RFfe4b9.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
69
DNS requests
54
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
302
104.111.242.51:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
—
—
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/gpe7ohs3f5omwhxxpxvcdvkwva_1.3.36.101/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.101_win_adeodp7n5nw3wgk7xjdln2w2sgsq.crx3
US
—
—
whitelisted
2084
chrome.exe
GET
301
104.21.14.244:80
http://serialms.com/
US
—
—
whitelisted
—
—
GET
302
104.111.242.51:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
2076
Setup.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
der
1.05 Kb
whitelisted
—
—
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/gpe7ohs3f5omwhxxpxvcdvkwva_1.3.36.101/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.101_win_adeodp7n5nw3wgk7xjdln2w2sgsq.crx3
US
binary
5.64 Kb
whitelisted
—
—
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/gpe7ohs3f5omwhxxpxvcdvkwva_1.3.36.101/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.101_win_adeodp7n5nw3wgk7xjdln2w2sgsq.crx3
US
binary
20.9 Kb
whitelisted
2076
Setup.exe
GET
200
2.16.186.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
der
1.11 Kb
whitelisted
—
—
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/gpe7ohs3f5omwhxxpxvcdvkwva_1.3.36.101/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.101_win_adeodp7n5nw3wgk7xjdln2w2sgsq.crx3
US
binary
9.71 Kb
whitelisted
—
—
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/gpe7ohs3f5omwhxxpxvcdvkwva_1.3.36.101/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.101_win_adeodp7n5nw3wgk7xjdln2w2sgsq.crx3
US
binary
9.71 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2084
chrome.exe
172.217.23.237:443
accounts.google.com
Google Inc.
US
unknown
2084
chrome.exe
2.18.234.217:443
package.avira.com
Akamai International B.V.
—
whitelisted
2084
chrome.exe
216.58.201.78:443
clients2.google.com
Google Inc.
US
whitelisted
2084
chrome.exe
172.217.23.238:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2084
chrome.exe
172.217.23.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3852
Avira.Spotlight.Bootstrapper.exe
107.178.240.159:443
api.mixpanel.com
Google Inc.
US
whitelisted
3852
Avira.Spotlight.Bootstrapper.exe
52.28.76.184:443
api.my.avira.com
Amazon.com, Inc.
DE
unknown
2084
chrome.exe
172.217.23.228:443
www.google.com
Google Inc.
US
whitelisted
2084
chrome.exe
104.21.14.244:80
serialms.com
Cloudflare Inc
US
unknown
—
—
104.21.14.244:80
serialms.com
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 216.58.201.78
whitelisted
package.avira.com
  • 2.18.234.217
suspicious
accounts.google.com
  • 172.217.23.237
shared
sb-ssl.google.com
  • 172.217.23.238
whitelisted
ssl.gstatic.com
  • 172.217.23.227
whitelisted
api.mixpanel.com
  • 107.178.240.159
  • 35.186.241.51
  • 130.211.34.183
  • 35.190.25.25
whitelisted
api.my.avira.com
  • 52.28.76.184
  • 18.194.11.217
unknown
go.microsoft.com
  • 104.111.242.51
whitelisted
download.visualstudio.microsoft.com
  • 68.232.34.200
whitelisted
www.google.com
  • 172.217.23.228
malicious

Threats

PID
Process
Class
Message
2980
keygen-step-1.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
2980
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
3104
keygen-step-6.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3104
keygen-step-6.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1696
KiffAppE2.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
1600
2CEA.tmp.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1600
2CEA.tmp.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1600
2CEA.tmp.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2928
key.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2928
key.exe
Generic Protocol Command Decode
SURICATA HTTP invalid response chunk len
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://package.avira.com/download/spotlight-windows-bootstrapper/avira_en_sptl1_abea7be69ff5a356__phpws-spotlight-release.exe