download:

RogueKiller.exe

Full analysis: https://app.any.run/tasks/a8036e23-d5ff-4293-a25e-87154576356b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 19, 2018, 09:42:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5E74C381F9FB45C90E6BEFA9BCC4BB58

SHA1:

6BF860FD9741CA2E35FC005ACA49152C6A6D2B8D

SHA256:

6A27C1918C0220057290A831003E3B87E56F9E7CEABD9BBA3E7F9602851B6EA0

SSDEEP:

393216:lMbh5fukl2/XcikpJsv6tWKFdu9Ci1170jKHpfU1S3sWD:l+Pfukl2/siZ10UUE3d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application loaded dropped or rewritten executable

      • RogueKiller.exe (PID: 4040)
      • wmiprvse.exe (PID: 2464)
      • chrome.exe (PID: 124)
      • chrome.exe (PID: 2476)
      • chrome.exe (PID: 2724)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 388)
      • chrome.exe (PID: 3172)
      • opera.exe (PID: 3200)
      • BMXH.exe (PID: 1888)
      • hostdl.exe (PID: 2124)
      • wmiprvse.exe (PID: 2356)
      • hostdl.exe (PID: 3140)
      • BMXH.exe (PID: 4076)
      • AUDIODG.EXE (PID: 3128)
      • csc.exe (PID: 1300)
      • conhost.exe (PID: 508)
      • cvtres.exe (PID: 2712)
      • defender.exe (PID: 2284)
      • opera.exe (PID: 3400)

    • Application was dropped or rewritten from another process

      • BMXH.exe (PID: 1888)
      • hostdl.exe (PID: 3140)
      • BMXH.exe (PID: 4076)
      • hostdl.exe (PID: 2124)
      • defender.exe (PID: 2284)

    • Changes the autorun value in the registry

      • BMXH.exe (PID: 1888)

  • SUSPICIOUS

    • Creates files in the program directory

      • RogueKiller.exe (PID: 4040)

    • Application launched itself

      • chrome.exe (PID: 4012)

    • Starts itself from another location

      • BMXH.exe (PID: 1888)

    • Creates files in the user directory

      • opera.exe (PID: 3200)

    • Modifies files in the system directory

      • BMXH.exe (PID: 1888)
      • csc.exe (PID: 1300)

    • Creates files in the Windows directory

      • BMXH.exe (PID: 1888)
      • hostdl.exe (PID: 3140)
      • csc.exe (PID: 1300)
      • hostdl.exe (PID: 2124)

    • Reads CPU info

      • wmiprvse.exe (PID: 2356)

    • Removes files from Windows directory

      • hostdl.exe (PID: 3140)
      • csc.exe (PID: 1300)
      • hostdl.exe (PID: 2124)

  • INFO

    • Dropped object may contain URL's

      • chrome.exe (PID: 4012)
      • BMXH.exe (PID: 1888)
      • opera.exe (PID: 3200)

    • Loads the .NET runtime environment

      • BMXH.exe (PID: 1888)
      • BMXH.exe (PID: 4076)
      • hostdl.exe (PID: 3140)
      • hostdl.exe (PID: 2124)
      • defender.exe (PID: 2284)

    • Dropped object may contain Bitcoin addresses

      • opera.exe (PID: 3200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:03:19 08:23:30+01:00
PEType: PE32
LinkerVersion: 10
CodeSize: 11118592
InitializedDataSize: 11499008
UninitializedDataSize: -
EntryPoint: 0x8f7edd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.12.9.0
ProductVersionNumber: 12.12.9.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: French
CharacterSet: Unicode
CompanyName: Adlice Software
FileDescription: Anti-malware remediation tool
FileVersion: 12.12.9.0
InternalName: RogueKiller Anti-malware
LegalCopyright: Copyright Adlice Software(C) 2015
LegalTrademarks1: Adlice Software
LegalTrademarks2: Adlice Software
OriginalFileName: RogueKiller
ProductName: RogueKiller
ProductVersion: 12.12.9.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Mar-2018 07:23:30
Detected languages:
  • English - United States
  • French - France
Debug artifacts:
  • C:\Adlice\RogueKillerQt\Release\RogueKillerQt.pdb
CompanyName: Adlice Software
FileDescription: Anti-malware remediation tool
FileVersion: 12.12.9.0
InternalName: RogueKiller Anti-malware
LegalCopyright: Copyright Adlice Software(C) 2015
LegalTrademarks1: Adlice Software
LegalTrademarks2: Adlice Software
OriginalFilename: RogueKiller
ProductName: RogueKiller
ProductVersion: 12.12.9.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 19-Mar-2018 07:23:30
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00A9A767
0x00A9A800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.69383
.rdata
0x00A9C000
0x004CDE4D
0x004CE000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.33337
.data
0x00F6A000
0x0005E2C0
0x00050C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.283
.qtmetad\x10\x01
0x00FC9000
0x00000110
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
2.96332
.rsrc
0x00FCA000
0x00540358
0x00540400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.72881
.reloc
0x0150B000
0x000982EC
0x00098400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.6154

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.0482
705
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.90056
296
Latin 1 / Western European
English - United States
RT_ICON
3
5.81827
3752
Latin 1 / Western European
English - United States
RT_ICON
4
6.17165
2216
Latin 1 / Western European
English - United States
RT_ICON
5
2.84132
132
Latin 1 / Western European
English - United States
RT_GROUP_ICON
6
7.96111
58148
Latin 1 / Western European
English - United States
RT_ICON
7
5.72261
9640
Latin 1 / Western European
English - United States
RT_ICON
8
5.79415
4264
Latin 1 / Western European
English - United States
RT_ICON
9
6.04788
1128
Latin 1 / Western European
English - United States
RT_ICON
99
6.68694
102457
Latin 1 / Western European
English - United States
BINARY

Imports

ADVAPI32.dll
CRYPT32.dll
GDI32.dll
IMM32.dll
KERNEL32.dll
OLEAUT32.dll
OPENGL32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll

Exports

Title
Ordinal
Address
ud_decode
1
0x001DA3C0
ud_disassemble
2
0x001CB0D0
ud_get_user_opaque_data
3
0x001CB320
ud_init
4
0x001CB030
ud_input_end
5
0x001CB4E0
ud_input_skip
6
0x001CB470
ud_insn_asm
7
0x001CB1B0
ud_insn_hex
8
0x001CB1D0
ud_insn_len
9
0x001CB260
ud_insn_mnemonic
10
0x001CB390
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
21
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start roguekiller.exe wmiprvse.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs opera.exe bmxh.exe hostdl.exe no specs wmiprvse.exe no specs bmxh.exe no specs hostdl.exe no specs csc.exe conhost.exe no specs audiodg.exe no specs cvtres.exe no specs defender.exe no specs opera.exe no specs roguekiller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=4020 --on-initialized-event-handle=296 --parent-handle=300 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,2098028435125299174,238460058067549734,131072 --service-pipe-token=13E19FD070951F0C1EEC044113041B2C --lang=en-US --disable-client-side-phishing-detection --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=13E19FD070951F0C1EEC044113041B2C --renderer-client-id=5 --mojo-platform-channel-handle=1564 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
508\??\C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1300"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ubnheuu3.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
hostdl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\ole32.dll
1888"C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\BMXH.exe" C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\BMXH.exe
opera.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Хoст-процеcс для cлужб Windоws
Exit code:
4294967295
Version:
1.0.0.9
Modules
Images
c:\users\admin\appdata\local\opera\opera\temporary_downloads\bmxh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2124"C:\WindowsData\hostdl.exe" "C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\BMXH.exe"C:\WindowsData\hostdl.exe—BMXH.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Хoст-процеcс для cлужб Windоws
Exit code:
0
Version:
1.0.0.9
Modules
Images
c:\windowsdata\hostdl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2284"C:\WindowsData\defender.exe" C:\WindowsData\defender.exe—hostdl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Antimalware service executable
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\windowsdata\defender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2356C:\Windows\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\system32\wbem\wmiprvse.exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.10586.117 (th2_release.160212-2359)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
2464C:\Windows\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\system32\wbem\wmiprvse.exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.10586.117 (th2_release.160212-2359)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2476"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,2098028435125299174,238460058067549734,131072 --service-pipe-token=802BE038D8D5D856170553731C569F43 --lang=en-US --disable-client-side-phishing-detection --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=802BE038D8D5D856170553731C569F43 --renderer-client-id=4 --mojo-platform-channel-handle=1632 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 206
Read events
989
Write events
214
Delete events
3

Modification events

(PID) Process:(4040) RogueKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RogueKiller.exe
Operation:writeName:DumpFolder
Value:
C:\ProgramData\RogueKiller\Debug
(PID) Process:(4040) RogueKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RogueKiller.exe
Operation:writeName:DumpCount
Value:
10
(PID) Process:(4040) RogueKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RogueKiller.exe
Operation:writeName:DumpType
Value:
2
(PID) Process:(4040) RogueKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RogueKiller.exe
Operation:writeName:CustomDumpFlags
Value:
0
(PID) Process:(4012) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4012) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4012) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(124) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:4012-13165926224724875
Value:
259
(PID) Process:(4012) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(4012) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
7
Suspicious files
217
Text files
501
Unknown types
32

Dropped files

PID
Process
Filename
Type
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\fd4d1580-0e1a-4043-acbe-5a1592b40a37.tmp —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\index —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000001.dbtmp —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.google.it_0.indexeddb.leveldb\000001.dbtmp —
MD5:—
SHA256:—
4012chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF166372.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
145
TCP/UDP connections
585
DNS requests
197
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
198.251.84.79:80
http://rgho.st/favicon.ico?v1
US
—
—
shared
—
—
GET
—
198.251.84.79:80
http://rgho.st/assets/fontawesome-webfont-6f4e5ad08a3e41079465a55a766dc929.woff?v=4.6.3
US
—
—
shared
—
—
GET
—
198.251.84.79:80
http://rgho.st/assets/toolkit-entypo-da776d00d77a6d9dd3a96c7855fc66c7.woff
US
—
—
shared
—
—
GET
—
198.251.84.79:80
http://rgho.st/logo.svg?v2
US
—
—
shared
—
—
GET
200
198.251.84.79:80
http://rgho.st/6m4YC9HPY
US
html
7.54 Kb
shared
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEANVpBFyBK7tOY7FcXAMYkI%3D
US
der
471 b
whitelisted
—
—
GET
200
172.217.22.78:80
http://clients1.google.com/complete/search?q=rghost&client=opera-suggest-omnibox&hl=en
US
text
131 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOXQPQlVpLtFek%2BmcpabOk%3D
US
der
471 b
whitelisted
—
—
GET
200
172.217.22.78:80
http://clients1.google.com/complete/search?q=rgh&client=opera-suggest-omnibox&hl=en
US
text
98 b
whitelisted
—
—
GET
200
198.251.84.79:80
http://rgho.st/assets/file-extensions-439d1aba2e24ecc5566654fa9870131d.woff
US
woff
45.8 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
178.33.106.117:443
download.adlice.com
OVH SAS
FR
suspicious
—
—
172.217.23.163:443
www.google.it
Google Inc.
US
whitelisted
—
—
216.58.208.36:443
www.google.com
Google Inc.
US
whitelisted
—
—
172.217.23.131:443
ssl.gstatic.com
Google Inc.
US
whitelisted
—
—
82.145.215.40:443
certs.opera.com
Opera Software AS
—
whitelisted
—
—
216.58.214.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
—
—
185.26.182.112:80
sitecheck2.opera.com
Opera Software AS
—
malicious
—
—
66.225.197.197:80
crl4.digicert.com
CacheNetworks, Inc.
US
whitelisted
—
—
198.251.84.79:80
rgho.st
FranTech Solutions
US
suspicious
—
—
88.212.201.207:80
counter.yadro.ru
United Network LLC
RU
unknown

DNS requests

Domain
IP
Reputation
download.adlice.com
  • 178.33.106.117
whitelisted
clientservices.googleapis.com
  • 216.58.214.99
whitelisted
www.google.it
  • 172.217.23.163
whitelisted
ssl.gstatic.com
  • 172.217.23.131
whitelisted
www.google.com
  • 216.58.208.36
malicious
certs.opera.com
  • 82.145.215.40
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl4.digicert.com
  • 66.225.197.197
whitelisted
clients1.google.com
  • 172.217.22.78
whitelisted
rgho.st
  • 198.251.84.79
shared

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RogueKiller.exe