File name:

Restoro.exe

Full analysis: https://app.any.run/tasks/620070bd-0193-4b0e-af96-1f34a3f746ed
Verdict: Malicious activity
Analysis date: February 25, 2024, 20:12:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

149B7754E41E3330E87D3C303FECE58C

SHA1:

609F69F21AF038A251698CA503AC0D1E3BF91693

SHA256:

5D99408FC2F7BC85F2C4BC6DCD762008BFECD5C8DCAAACF9C9BDC2914DDD22B1

SSDEEP:

12288:SEiLxas2VYHhJfEj2YxSjzbzbJln4GIyFNj+GRwWxsseOxd0:StxRBJMj2YxqnPn+GjiWxszOxy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Actions looks like stealing of personal data

      • Restoro.exe (PID: 2848)
      • sqlite3.exe (PID: 3936)
      • sqlite3.exe (PID: 4000)
      • sqlite3.exe (PID: 2444)
      • Restoro.exe (PID: 2568)
      • sqlite3.exe (PID: 1216)
      • sqlite3.exe (PID: 2748)
      • sqlite3.exe (PID: 4080)

    • Steals credentials from Web Browsers

      • Restoro.exe (PID: 2848)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Connects to the CnC server

      • Restoro.exe (PID: 2848)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • The process creates files with name similar to system file names

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Starts application with an unusual extension

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Executing commands from a ".bat" file

      • nsFC65.tmp (PID: 3948)
      • nsFD03.tmp (PID: 4060)
      • nsFD92.tmp (PID: 2648)
      • ns38BD.tmp (PID: 1636)
      • ns39CB.tmp (PID: 2616)
      • ns393C.tmp (PID: 1020)

    • The executable file from the user directory is run by the CMD process

      • sqlite3.exe (PID: 3936)
      • sqlite3.exe (PID: 2444)
      • sqlite3.exe (PID: 4000)
      • sqlite3.exe (PID: 1216)
      • sqlite3.exe (PID: 2748)
      • sqlite3.exe (PID: 4080)

    • Starts CMD.EXE for commands execution

      • nsFD92.tmp (PID: 2648)
      • nsFC65.tmp (PID: 3948)
      • nsFD03.tmp (PID: 4060)
      • nsFE3F.tmp (PID: 3392)
      • ns38F.tmp (PID: 848)
      • ns38BD.tmp (PID: 1636)
      • ns39CB.tmp (PID: 2616)
      • ns3F3C.tmp (PID: 1652)
      • ns3A78.tmp (PID: 3352)
      • ns393C.tmp (PID: 1020)

    • Reads browser cookies

      • sqlite3.exe (PID: 2444)

    • Get information on the list of running processes

      • nsFE3F.tmp (PID: 3392)
      • cmd.exe (PID: 2420)
      • ns38F.tmp (PID: 848)
      • cmd.exe (PID: 1656)
      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)
      • ns3A78.tmp (PID: 3352)
      • cmd.exe (PID: 1956)
      • ns3F3C.tmp (PID: 1652)
      • cmd.exe (PID: 4092)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3324)
      • regsvr32.exe (PID: 3808)

    • Reads security settings of Internet Explorer

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Reads the Internet Settings

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Executable content was dropped or overwritten

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Uses NSLOOKUP.EXE to check DNS info

      • Restoro.exe (PID: 2848)

  • INFO

    • Checks supported languages

      • Restoro.exe (PID: 2848)
      • nsFC65.tmp (PID: 3948)
      • sqlite3.exe (PID: 3936)
      • nsFD92.tmp (PID: 2648)
      • sqlite3.exe (PID: 2444)
      • nsFD03.tmp (PID: 4060)
      • sqlite3.exe (PID: 4000)
      • nsFE3F.tmp (PID: 3392)
      • ns38F.tmp (PID: 848)
      • sqlite3.exe (PID: 1216)
      • ns393C.tmp (PID: 1020)
      • Restoro.exe (PID: 2568)
      • ns38BD.tmp (PID: 1636)
      • sqlite3.exe (PID: 2748)
      • ns39CB.tmp (PID: 2616)
      • sqlite3.exe (PID: 4080)
      • ns3F3C.tmp (PID: 1652)
      • ns3A78.tmp (PID: 3352)

    • Reads the computer name

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Reads the machine GUID from the registry

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Create files in a temporary directory

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Creates files or folders in the user directory

      • sqlite3.exe (PID: 2444)

    • Checks proxy server information

      • Restoro.exe (PID: 2848)
      • Restoro.exe (PID: 2568)

    • Manual execution by a user

      • Restoro.exe (PID: 1484)
      • Restoro.exe (PID: 2568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:59+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28672
InitializedDataSize: 446464
UninitializedDataSize: 16896
EntryPoint: 0x39e3
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.0.2.8
ProductVersionNumber: 2.0.2.8
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Restoro
FileDescription: Restoro Downloader
FileVersion: 2.028
InternalName: Restoro Downloader
LegalCopyright: © Restoro
LegalTrademarks: Restoro
ProductName: Restoro
ProductVersion: 2.028
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
39
Malicious processes
13
Suspicious processes
7

Behavior graph

Click at the process to see the details
start restoro.exe nsfc65.tmp no specs cmd.exe no specs sqlite3.exe nsfd03.tmp no specs cmd.exe no specs sqlite3.exe nsfd92.tmp no specs cmd.exe no specs sqlite3.exe nsfe3f.tmp no specs cmd.exe no specs tasklist.exe no specs ns38f.tmp no specs cmd.exe no specs tasklist.exe no specs regsvr32.exe no specs ping.exe no specs nslookup.exe tasklist.exe no specs restoro.exe no specs restoro.exe ns38bd.tmp no specs cmd.exe no specs sqlite3.exe ns393c.tmp no specs cmd.exe no specs sqlite3.exe ns39cb.tmp no specs cmd.exe no specs sqlite3.exe ns3a78.tmp no specs cmd.exe no specs tasklist.exe no specs ns3f3c.tmp no specs cmd.exe no specs tasklist.exe no specs regsvr32.exe no specs restoro.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Users\admin\AppData\Local\Temp\nssFB88.tmp\ns38F.tmp" cmd /C tasklist /FI "IMAGENAME eq avupdate.exe" > C:\Users\admin\AppData\Local\Temp\IsProcessActive.txtC:\Users\admin\AppData\Local\Temp\nssFB88.tmp\ns38F.tmp—Restoro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nssfb88.tmp\ns38f.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
880ping.exe -n 4 www.google.comC:\Windows\System32\PING.EXE—Restoro.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
896tasklist /FI "IMAGENAME eq avupdate.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1020"C:\Users\admin\AppData\Local\Temp\nsx37D1.tmp\ns393C.tmp" "C:\Users\admin\AppData\Local\Temp\FF.bat" > C:\Users\admin\AppData\Local\Temp\FF.txtC:\Users\admin\AppData\Local\Temp\nsx37D1.tmp\ns393C.tmp—Restoro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\nsx37d1.tmp\ns393c.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1040C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\FF.bat" > C:\Users\admin\AppData\Local\Temp\FF.txt"C:\Windows\System32\cmd.exe—nsFC65.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1216"C:\Users\admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'restoro.com' and name='_trackid_product_24';"C:\Users\admin\AppData\Local\Temp\sqlite3.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\sqlite3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
1484"C:\Users\admin\AppData\Local\Temp\Restoro.exe" /ResumeInstall=2 /Language=1033 /ABver=Default /pxkp=Delete /StartScan=0 /ShowSettings=false /ScanConfirm=falseC:\Users\admin\AppData\Local\Temp\Restoro.exe—explorer.exe
User:
admin
Company:
Restoro
Integrity Level:
MEDIUM
Description:
Restoro Downloader
Exit code:
3221226540
Version:
2.028
Modules
Images
c:\users\admin\appdata\local\temp\restoro.exe
c:\windows\system32\ntdll.dll
1624"tasklist.exe"C:\Windows\System32\tasklist.exe—Restoro.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1636"C:\Users\admin\AppData\Local\Temp\nsx37D1.tmp\ns38BD.tmp" "C:\Users\admin\AppData\Local\Temp\FF.bat" > C:\Users\admin\AppData\Local\Temp\FF.txtC:\Users\admin\AppData\Local\Temp\nsx37D1.tmp\ns38BD.tmp—Restoro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\nsx37d1.tmp\ns38bd.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1652"C:\Users\admin\AppData\Local\Temp\nsx37D1.tmp\ns3F3C.tmp" cmd /C tasklist /FI "IMAGENAME eq avupdate.exe" > C:\Users\admin\AppData\Local\Temp\IsProcessActive.txtC:\Users\admin\AppData\Local\Temp\nsx37D1.tmp\ns3F3C.tmp—Restoro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsx37d1.tmp\ns3f3c.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
7 710
Read events
7 487
Write events
61
Delete events
162

Modification events

(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2848) Restoro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
30
Suspicious files
1
Text files
25
Unknown types
2

Dropped files

PID
Process
Filename
Type
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\nssFB88.tmp\System.dllexecutable
MD5:BF712F32249029466FA86756F5546950
SHA256:7851CB12FA4131F1FEE5DE390D650EF65CAC561279F1CFE70AD16CC9780210AF
2848Restoro.exeC:\Windows\restoro.initext
MD5:1C940039C154EE9A35DAC3A627A313D9
SHA256:EFF0F4511EEF90A832E2C219E609B0D428AF8E12E7C1FEB065281DA0886A32F6
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\sqlite3.exeexecutable
MD5:91CDCEA4BE94624E198D3012F5442584
SHA256:CA4C0F1EC0CCBC9988EA3F43FF73FE84228FFB4D76BADDC386051DFFE7DDD8C2
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\nssFB88.tmp\UserInfo.dllexecutable
MD5:C7CE0E47C83525983FD2C4C9566B4AAD
SHA256:6293408A5FA6D0F55F0A4D01528EB5B807EE9447A75A28B5986267475EBCD3AE
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\nsnFC54.tmptext
MD5:D843E45CE0B4070AC9A73177EAC866A4
SHA256:3D95AB7F1C43E04A9181494AD60A569BFE4843EB90DEE314ED4BBE2E81A9D0D5
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\FF.battext
MD5:D843E45CE0B4070AC9A73177EAC866A4
SHA256:3D95AB7F1C43E04A9181494AD60A569BFE4843EB90DEE314ED4BBE2E81A9D0D5
2420cmd.exeC:\Users\admin\AppData\Local\Temp\IsProcessActive.txttext
MD5:DEA052A2AD11945B1960577C0192F2EB
SHA256:943B315E065238B7073B033F534EF954B6B6461FB3F03A3F5B8555B11BC4C0A2
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\nssFB88.tmp\nsExec.dllexecutable
MD5:132E6153717A7F9710DCEA4536F364CD
SHA256:D29AFCE2588D8DD7BB94C00CA91CAC0E85B80FFA6B221F5FFCB83A2497228EB2
2848Restoro.exeC:\Users\admin\AppData\Local\Temp\nsoFCF3.tmptext
MD5:B9A2323FDD9C157AB19E73DDB6C5E334
SHA256:59E61CA9B1DBFB84C72DFF57EF401DFC5938891DCEF3A7A662AAE22E7F4B5F7B
1656cmd.exeC:\Users\admin\AppData\Local\Temp\IsProcessActive.txttext
MD5:DEA052A2AD11945B1960577C0192F2EB
SHA256:943B315E065238B7073B033F534EF954B6B6461FB3F03A3F5B8555B11BC4C0A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
15
DNS requests
6
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/includes/install_start.php?m_trackid=&m_tracking=&m_campaign=&minorsessionid=eac35f91eaab48b59e830a838e&sessionid=ad11a0da-6758-4243-b96c-f5d11bd2f72f&t=CONSUMER&a=ENABLED&u=ENABLED&c=DISABLED&v=2028
unknown
—
—
unknown
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/version.php?type=downloader
unknown
—
—
unknown
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/version.php?type=downloader
unknown
—
—
unknown
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/evt.php?version=2028&SessionID=ad11a0da-6758-4243-b96c-f5d11bd2f72f&MinorSessionID=eac35f91eaab48b59e830a838e&id=INSST&param=&trackutil=
unknown
—
—
unknown
2848
Restoro.exe
GET
404
23.253.160.91:80
http://org.restoro.com/lib/version.php?type=downloader
unknown
html
1.22 Kb
unknown
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/evt.php?version=2028&SessionID=ad11a0da-6758-4243-b96c-f5d11bd2f72f&MinorSessionID=eac35f91eaab48b59e830a838e&id=INPRC&param=IMEDICTUPDATE*taskhost*taskeng*dwm*ctfmon*audiodg*msiexec*Restoro*&trackutil=
unknown
—
—
unknown
2568
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/version.php?type=downloader
unknown
—
—
unknown
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/evt.php?version=2028&SessionID=ad11a0da-6758-4243-b96c-f5d11bd2f72f&MinorSessionID=eac35f91eaab48b59e830a838e&id=USERTYPE&param=New&trackutil=
unknown
—
—
unknown
2568
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/version.php?type=downloader
unknown
—
—
unknown
2848
Restoro.exe
GET
—
104.22.60.250:80
http://www.restoro.com/lib/evt.php?version=2028&SessionID=ad11a0da-6758-4243-b96c-f5d11bd2f72f&MinorSessionID=eac35f91eaab48b59e830a838e&id=ININF&param=OS=7<*>AV=<*>Firewall=<*>GooglePing=<*>nslookup=cloud.restoro.com<*>File=NotExitst<*>path=C:\Users\admin\AppData\Local\Temp\restoro-downloader.xml&trackutil=
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2848
Restoro.exe
104.22.60.250:80
www.restoro.com
CLOUDFLARENET
—
unknown
2848
Restoro.exe
23.253.160.91:80
org.restoro.com
RACKSPACE
US
unknown
2568
Restoro.exe
104.22.60.250:80
www.restoro.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
www.restoro.com
  • 104.22.60.250
malicious
org.restoro.com
  • 23.253.160.91
unknown
www.google.com
  • 142.250.186.100
whitelisted
2.100.168.192.in-addr.arpa
  • —
unknown
cloud.restoro.com
  • 3.161.82.25
  • 2600:9000:26e8:4000:6:3c88:df40:93a1
shared

Threats

PID
Process
Class
Message
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Win32/ReImageRepair.T CnC Checkin
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Win32/ReImageRepair.T CnC Checkin
2848
Restoro.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2848
Restoro.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Win32/ReImageRepair.T CnC Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Restoro.exe