File name:

2a9966.msi

Full analysis: https://app.any.run/tasks/f6e648e4-32ac-4453-9a1c-ae0d6052153b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 27, 2018, 13:45:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
trojan
loader
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Widgi Toolbar, Keywords: Installer,MSI,Database, Subject: Widgi Toolbar, Author: Spigot, Inc., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2012 Spring - Premier Edition 19, Last Saved Time/Date: Wed May 15 13:48:51 2013, Create Time/Date: Wed May 15 13:48:51 2013, Last Printed: Wed May 15 13:48:51 2013, Revision Number: {320B1C6C-43AA-44BB-8D45-D8BFC83F9226}, Code page: 0, Template: Intel;0,1033,1036,1031,1040,1034
MD5:

23D78FDC2FEA33F095480180DCA49D94

SHA1:

426301F902FE427B57AB0E2CB844049699158274

SHA256:

6955C05A75D4450B46E279CFFF40F1F5F4C383A3CBD719EA75D784E283CF4CEA

SSDEEP:

98304:X+9YytEasYjgp5yXVt5sxPzfk5IjsCzdJvWfttYFdfrHvhTiEBs+AmscXG047OPJ:X+nsUsJk0G8FdfdeqxAjc20oOP6u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • pdfforgeExtension.exe (PID: 3708)
      • PreferencesManager.exe (PID: 332)
      • SearchSettings.exe (PID: 2716)
      • SearchSettings.exe (PID: 964)
      • ApplicationUpdater.exe (PID: 3476)

    • Downloads executable files from the Internet

      • ApplicationUpdater.exe (PID: 3536)

    • Loads dropped or rewritten executable

      • explorer.exe (PID: 1676)
      • SearchSettings.exe (PID: 2716)
      • iexplore.exe (PID: 3924)
      • dwm.exe (PID: 1588)
      • iexplore.exe (PID: 3104)
      • taskhost.exe (PID: 1880)
      • svchost.exe (PID: 868)
      • FlashUtil32_27_0_0_187_ActiveX.exe (PID: 1008)
      • msiexec.exe (PID: 2332)

  • SUSPICIOUS

    • Starts Microsoft Installer

      • explorer.exe (PID: 1676)
      • pdfforgeExtension.exe (PID: 3708)

    • Creates or modifies windows services

      • svchost.exe (PID: 868)

    • Creates COM task schedule object

      • msiexec.exe (PID: 1576)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 1576)

    • Removes files from Windows directory

      • ApplicationUpdater.exe (PID: 3536)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2332)
      • ApplicationUpdater.exe (PID: 3536)
      • msiexec.exe (PID: 1576)

    • Creates files in the user directory

      • SearchSettings.exe (PID: 2716)

    • Creates files in the Windows directory

      • ApplicationUpdater.exe (PID: 3536)

    • Starts Internet Explorer

      • MsiExec.exe (PID: 3944)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 792)

    • Application launched itself

      • msiexec.exe (PID: 1576)

    • Creates or modifies windows services

      • msiexec.exe (PID: 1576)
      • vssvc.exe (PID: 792)

    • Dropped object may contain URL's

      • MsiExec.exe (PID: 3572)
      • MsiExec.exe (PID: 3024)
      • SearchSettings.exe (PID: 2716)
      • msiexec.exe (PID: 2332)
      • iexplore.exe (PID: 3924)
      • pdfforgeExtension.exe (PID: 3708)
      • iexplore.exe (PID: 3104)
      • MsiExec.exe (PID: 3704)
      • msiexec.exe (PID: 1576)

    • Creates files in the program directory

      • msiexec.exe (PID: 1576)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1576)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3924)

    • Changes internet zones settings

      • iexplore.exe (PID: 3104)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3924)

    • Creates files in the user directory

      • iexplore.exe (PID: 3924)
      • FlashUtil32_27_0_0_187_ActiveX.exe (PID: 1008)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3944)
      • MsiExec.exe (PID: 3572)
      • MsiExec.exe (PID: 3024)
      • MsiExec.exe (PID: 3276)
      • MsiExec.exe (PID: 3704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.2)
.mst | Windows SDK Setup Transform Script (9.5)
.flo | iGrafx FlowCharter document (5)
. | Generic OLE2 / Multistream Compound File (1.2)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Widgi Toolbar
Comments: -
Keywords: Installer,MSI,Database
Subject: Widgi Toolbar
Author: Spigot, Inc.
Security: Password protected
Pages: 200
Software: InstallShield? 2012 Spring - Premier Edition 19
ModifyDate: 2013:05:15 12:48:51
CreateDate: 2013:05:15 12:48:51
LastPrinted: 2013:05:15 12:48:51
RevisionNumber: {320B1C6C-43AA-44BB-8D45-D8BFC83F9226}
CodePage: Unknown (0)
Template: Intel;0,1033,1036,1031,1040,1034
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
22
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe msiexec.exe no specs applicationupdater.exe searchsettings.exe iexplore.exe iexplore.exe flashutil32_27_0_0_187_activex.exe no specs pdfforgeextension.exe no specs msiexec.exe no specs msiexec.exe searchsettings.exe no specs msiexec.exe no specs applicationupdater.exe dwm.exe no specs explorer.exe no specs taskhost.exe no specs svchost.exe preferencesmanager.exe

Process information

PID
CMD
Path
Indicators
Parent process
332"C:\Program Files\Common Files\Spigot\Preferences Manager\PreferencesManager.exe" /reset 0 DFROMKITAUTOUPDATEC:\Program Files\Common Files\Spigot\Preferences Manager\PreferencesManager.exe
msiexec.exe
User:
admin
Company:
CloudSoftware
Integrity Level:
HIGH
Description:
Preferences Manager
Exit code:
0
Version:
27, 8, 0, 3
Modules
Images
c:\program files\common files\spigot\preferences manager\preferencesmanager.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
792C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
868C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
964"C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe" UNHOOKC:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe—MsiExec.exe
User:
admin
Company:
Spigot, Inc.
Integrity Level:
HIGH
Description:
Search Settings
Exit code:
0
Version:
7, 1, 0, 3
Modules
Images
c:\program files\common files\spigot\search settings\searchsettings.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1008C:\Windows\system32\Macromed\Flash\FlashUtil32_27_0_0_187_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_27_0_0_187_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 27.0 r0
Exit code:
0
Version:
27,0,0,187
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_27_0_0_187_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1576C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1588"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1676C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1880"taskhost.exe"C:\Windows\System32\taskhost.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2332"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\2a9966.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 184
Read events
1 233
Write events
753
Delete events
198

Modification events

(PID) Process:(1676) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:Zvpebfbsg.Jvaqbjf.JvaqbjfVafgnyyre
Value:
00000000000000000000000062020000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(1676) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000000E0000001300000033270D000400000001000000190801004D006900630072006F0073006F00660074002E0049006E007400650072006E00650074004500780070006C006F007200650072002E00440065006600610075006C007400000000000000000000000000230000000000000000000000000000000000000000000000000000002A0C580260E9180213005802E20B58026FA9A5750600000005000000E20B580230B5580204E91802E8AAA5757B030119F8E8180200EB180230B55802000000000500000001000000DCE918026229A8757B03011930B5580206000000C80C58020000000000EB180208EB180210A65802CC0A580210000000000000000000000000000000000000000600000000000000230000006C61746E64666C740000000040000000AC54A57500000000C054A5757B03011930B55802000000000000000000000000E00B580230B55802ACE9183138EE18023F0400009021230038EA18021100000010471E0008471E00000000003F040000D6160E747B03011928EA0000150DB2ADD8E918028291E67528EA1802448B0000010DB2ADECE91802B69CE675488B25004C06000004EA1802B886250010EA1802789CE6753691E67540B018761100000010471E0008471E00D88625007CEA0000C10EB2AD2CEA18028291E6757CEA180230EA18022795E67500000000448B250058EA1802CD94E675448B250004EB1802B8862500E194E67500000000B886250004EB180260EA180200000000070000003FE402007B00440036003500320033003100420030002D0042003200460031002D0034003800350037002D0041003400430045002D004100380045003700430036004500410037004400320037007D005C007400610073006B006D00670072002E0065007800650000005802EC0A5802D0E818025869A67500000000D0075802F0E818020B8CA5750100000000000000537AA575560401020020000000000000010000003CE918023617DB7556040102100858020500000000000000FFFFFFFFD00758020000000038E9180264E9180200000000000000000000000090E9180218EC2300000000004091A4750900800188E918023559DB7556040102D09028000500000070E91802506AA6751CC0AA7501000000EF7AA575560401021D0000000020000088E918026359DB7590E918020000000000000000560401024066A07501000000F4E91802A13673750000000000000000C80B2300F4E91802B8367375E09276750000000000001B00D090280000000000F0E91802070014006AC2C1C10000000000000000CF6771758890280001000000C8902800FCE91802E82C0677C80B2300CF67717518EC1802C89028001100000010471E0008471E00000000007CEA0000C10EB2AD2CEA18028291E6757CEA180230EA18022795E67500000000448B250058EA1802CD94E675448B250004EB1802B8862500E194E67500000000B886250004EB180260EA180200000000070000003FE402007B00440036003500320033003100420030002D0042003200460031002D0034003800350037002D0041003400430045002D004100380045003700430036004500410037004400320037007D005C007400610073006B006D00670072002E0065007800650000005802EC0A5802D0E818025869A67500000000D0075802F0E818020B8CA5750100000000000000537AA575560401020020000000000000010000003CE918023617DB7556040102100858020500000000000000FFFFFFFFD00758020000000038E9180264E9180200000000000000000000000090E9180218EC2300000000004091A4750900800188E918023559DB7556040102D09028000500000070E91802506AA6751CC0AA7501000000EF7AA575560401021D0000000020000088E918026359DB7590E918020000000000000000560401024066A07501000000F4E91802A13673750000000000000000C80B2300F4E91802B8367375E09276750000000000001B00D090280000000000F0E91802070014006AC2C1C10000000000000000CF6771758890280001000000C8902800FCE91802E82C0677C80B2300CF67717518EC1802C89028001100000010471E0008471E00000000007CEA0000C10EB2AD2CEA18028291E6757CEA180230EA18022795E67500000000448B250058EA1802CD94E675448B250004EB1802B8862500E194E67500000000B886250004EB180260EA1802
(PID) Process:(1576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000A09CC43E1D0ED40128060000A80A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000A09CC43E1D0ED40128060000A80A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
50
(PID) Process:(1576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000CC48323F1D0ED40128060000A80A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000800D373F1D0ED40128060000300C0000E8030000010000000000000000000000CD7374293772B64E9746E4DA5A9D65B80000000000000000
(PID) Process:(792) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000050204A3F1D0ED40118030000C80E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(792) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000050204A3F1D0ED401180300004C0A0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(792) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000050204A3F1D0ED40118030000D40E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
20
Suspicious files
13
Text files
115
Unknown types
6

Dropped files

PID
Process
Filename
Type
2332msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA27B.tmp —
MD5:—
SHA256:—
2332msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA337.tmp —
MD5:—
SHA256:—
2332msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA358.tmp —
MD5:—
SHA256:—
2332msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA359.tmp —
MD5:—
SHA256:—
1576msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1576msiexec.exeC:\Windows\Installer\1b23ef.msi —
MD5:—
SHA256:—
1576msiexec.exeC:\Windows\Installer\MSI277A.tmp —
MD5:—
SHA256:—
1576msiexec.exeC:\Windows\Installer\MSI277B.tmp —
MD5:—
SHA256:—
1576msiexec.exeC:\Windows\Installer\MSI28D3.tmp —
MD5:—
SHA256:—
792vssvc.exeC: —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
18
DNS requests
11
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3476
ApplicationUpdater.exe
POST
—
174.37.213.243:80
http://www.cloudnetworktools.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/vaus/14/
US
—
—
malicious
3924
iexplore.exe
GET
200
174.36.215.20:80
http://pdfforge.mybrowserbar.com/image/1/1/pdfforge/1231869545/pdfc_portal_logo.gif
US
image
2.47 Kb
malicious
3704
MsiExec.exe
POST
—
174.37.213.243:80
http://pdfforge.cloudnetworktools.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/vrst/4
US
—
—
malicious
3924
iexplore.exe
GET
200
174.36.215.20:80
http://pdfforge.mybrowserbar.com/image/1/2/pdfforge/1261096968/pdfc_portal_tb.gif
US
image
14.2 Kb
malicious
3476
ApplicationUpdater.exe
POST
—
174.37.213.243:80
http://www.cloudnetworktools.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/ping/14/73/
US
—
—
malicious
332
PreferencesManager.exe
POST
200
174.37.213.243:80
http://api.cloudnetworktools.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/vloc/10
US
text
1.08 Kb
malicious
3572
MsiExec.exe
POST
200
174.36.215.20:80
http://pdfforge.mybrowserbar.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/vloc/4
US
text
560 b
malicious
3704
MsiExec.exe
GET
404
174.37.240.162:80
http://www.apps-prodownload.com/kits/pm/ProgramManager.exe
US
html
224 b
malicious
3572
MsiExec.exe
POST
200
174.36.215.20:80
http://pdfforge.mybrowserbar.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/vrst/4
US
text
43 b
malicious
3536
ApplicationUpdater.exe
POST
200
174.36.215.20:80
http://www.mybrowserbar.com/cgi/api.cgi/971163/3F00C12047C74A6A83DA184CAD75ED36/vaus/14/
US
text
239 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
MsiExec.exe
174.36.215.20:80
pdfforge.mybrowserbar.com
SoftLayer Technologies Inc.
US
malicious
2716
SearchSettings.exe
87.248.98.8:80
www.yahoo.com
Yahoo! UK Services Limited
GB
shared
2716
SearchSettings.exe
87.248.98.8:443
www.yahoo.com
Yahoo! UK Services Limited
GB
shared
2716
SearchSettings.exe
174.36.215.20:80
pdfforge.mybrowserbar.com
SoftLayer Technologies Inc.
US
malicious
3536
ApplicationUpdater.exe
174.36.215.20:80
pdfforge.mybrowserbar.com
SoftLayer Technologies Inc.
US
malicious
3536
ApplicationUpdater.exe
216.137.61.226:80
update.cloudnetworktools.com
Amazon.com, Inc.
US
unknown
3104
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3924
iexplore.exe
174.36.215.20:80
pdfforge.mybrowserbar.com
SoftLayer Technologies Inc.
US
malicious
3924
iexplore.exe
172.217.22.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3476
ApplicationUpdater.exe
174.37.213.243:80
pdfforge.cloudnetworktools.com
SoftLayer Technologies Inc.
US
malicious

DNS requests

Domain
IP
Reputation
pdfforge.mybrowserbar.com
  • 174.36.215.20
malicious
www.yahoo.com
  • 87.248.98.8
  • 87.248.98.7
whitelisted
api.mybrowserbar.com
  • 174.36.215.20
malicious
www.mybrowserbar.com
  • 174.36.215.20
malicious
update.cloudnetworktools.com
  • 216.137.61.226
  • 216.137.61.126
  • 216.137.61.6
  • 216.137.61.185
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google-analytics.com
  • 172.217.22.110
whitelisted
pdfforge.cloudnetworktools.com
  • 174.37.213.243
malicious
www.cloudnetworktools.com
  • 174.37.213.243
malicious
www.apps-prodownload.com
  • 174.37.240.162
malicious

Threats

PID
Process
Class
Message
3572
MsiExec.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
3572
MsiExec.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
2716
SearchSettings.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
3536
ApplicationUpdater.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3536
ApplicationUpdater.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
3536
ApplicationUpdater.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
3476
ApplicationUpdater.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
3476
ApplicationUpdater.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
3704
MsiExec.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
332
PreferencesManager.exe
A Network Trojan was detected
ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2a9966.msi