analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Geometry_Dash-285082.exe

Full analysis: https://app.any.run/tasks/b3b5b2e3-bde4-4095-9245-2e725fbb593b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 22:04:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

045CD8A6189DD15AD2B8E394F19B32F6

SHA1:

3AE29EE703CF7CA59806783BC1CEAA4CBFA0EFE0

SHA256:

702939D19FE783284BA1E80A33490CAF3623A248A6DE5C933A34BCA17D01F5B8

SSDEEP:

196608:R1p0qUlrB8q6W1QmXZTkFkUpmKtX4vGoO85zxkGrs:Rf0ZlsuNZW2vw8Jps

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Geometry_Dash-285082.exe (PID: 2024)

    • Drops executable file immediately after starts

      • Geometry_Dash-285082.exe (PID: 2024)
      • yandex_downloader.exe (PID: 2940)
      • MsiExec.exe (PID: 1888)
      • Yandex.exe (PID: 3740)

    • Loads dropped or rewritten executable

      • uFiler.exe (PID: 2316)
      • Geometry_Dash-285082.exe (PID: 2024)

    • Changes settings of System certificates

      • yandex_downloader.exe (PID: 2940)

    • Application was dropped or rewritten from another process

      • yandex_downloader.exe (PID: 2940)
      • yandex_downloader.exe (PID: 2436)
      • YandexPackSetup.exe (PID: 3700)
      • Yandex.exe (PID: 3740)
      • seederexe.exe (PID: 2336)
      • sender.exe (PID: 352)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)
      • lite_installer.exe (PID: 2760)

    • Actions looks like stealing of personal data

      • lite_installer.exe (PID: 2760)
      • seederexe.exe (PID: 2336)

    • Steals credentials from Web Browsers

      • seederexe.exe (PID: 2336)

  • SUSPICIOUS

    • Reads the computer name

      • Geometry_Dash-285082.exe (PID: 1288)
      • Geometry_Dash-285082.exe (PID: 2024)
      • Geometry_Dash-285082.exe (PID: 828)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • YandexPackSetup.exe (PID: 3700)
      • yandex_downloader.exe (PID: 2436)
      • lite_installer.exe (PID: 2760)
      • seederexe.exe (PID: 2336)
      • Yandex.exe (PID: 3740)
      • sender.exe (PID: 352)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Checks supported languages

      • Geometry_Dash-285082.exe (PID: 1288)
      • Geometry_Dash-285082.exe (PID: 2024)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 1988)
      • Geometry_Dash-285082.exe (PID: 828)
      • cmd.exe (PID: 3204)
      • cmd.exe (PID: 3904)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • YandexPackSetup.exe (PID: 3700)
      • yandex_downloader.exe (PID: 2436)
      • lite_installer.exe (PID: 2760)
      • seederexe.exe (PID: 2336)
      • Yandex.exe (PID: 3740)
      • sender.exe (PID: 352)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Executable content was dropped or overwritten

      • Geometry_Dash-285082.exe (PID: 2024)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)
      • Yandex.exe (PID: 3740)
      • lite_installer.exe (PID: 2760)

    • Creates files in the program directory

      • Geometry_Dash-285082.exe (PID: 2024)
      • uFiler.exe (PID: 2316)

    • Creates a directory in Program Files

      • Geometry_Dash-285082.exe (PID: 2024)

    • Drops a file that was compiled in debug mode

      • Geometry_Dash-285082.exe (PID: 2024)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)
      • Yandex.exe (PID: 3740)
      • lite_installer.exe (PID: 2760)

    • Application launched itself

      • Geometry_Dash-285082.exe (PID: 1288)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)

    • Changes default file association

      • Geometry_Dash-285082.exe (PID: 2024)

    • Starts CMD.EXE for commands execution

      • Geometry_Dash-285082.exe (PID: 2024)

    • Starts itself from another location

      • Geometry_Dash-285082.exe (PID: 828)

    • Creates a software uninstall entry

      • Geometry_Dash-285082.exe (PID: 1288)
      • Yandex.exe (PID: 3740)

    • Reads the date of Windows installation

      • uFiler.exe (PID: 2316)
      • Yandex.exe (PID: 3740)

    • Creates files in the user directory

      • uFiler.exe (PID: 2316)
      • MsiExec.exe (PID: 1888)
      • seederexe.exe (PID: 2336)
      • Yandex.exe (PID: 3740)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2104)

    • Executed as Windows Service

      • msiexec.exe (PID: 2104)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2104)

    • Reads Environment values

      • MsiExec.exe (PID: 1888)

    • Changes the started page of IE

      • seederexe.exe (PID: 2336)

    • Searches for installed software

      • seederexe.exe (PID: 2336)

    • Reads default file associations for system extensions

      • Yandex.exe (PID: 3740)

    • Drops a file with a compile date too recent

      • lite_installer.exe (PID: 2760)

  • INFO

    • Reads settings of System Certificates

      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • lite_installer.exe (PID: 2760)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Checks Windows Trust Settings

      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • lite_installer.exe (PID: 2760)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Reads the computer name

      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)

    • Checks supported languages

      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)

    • Manual execution by user

      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:06:03 22:05:17+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 8876032
InitializedDataSize: 131072
UninitializedDataSize: 17977344
EntryPoint: 0x199bd40
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2020.1.15.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: uFiler.pro
FileVersion: 2020.1.15.0
OriginalFileName: uFiler.exe
ProductName: uFiler
ProductVersion: 1.0.0
ProgramID: com.embarcadero.uFiler
FileDescription: uFiler

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Jun-2021 20:05:17

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 03-Jun-2021 20:05:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x01125000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x01126000
0x00877000
0x00876200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93355
.rsrc
0x0199D000
0x00020000
0x0001F800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.36005

Imports

KERNEL32.DLL
PSAPI.dll
SHFolder.dll
advapi32.dll
comctl32.dll
comdlg32.dll
d3d9.dll
gdi32.dll
mpr.dll
msvcrt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
18
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start geometry_dash-285082.exe no specs geometry_dash-285082.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs geometry_dash-285082.exe no specs ufiler.exe yandex_downloader.exe yandexpacksetup.exe yandex_downloader.exe msiexec.exe msiexec.exe lite_installer.exe seederexe.exe yandex.exe sender.exe {e074a25c-f02e-4af9-a881-7dd16d5a272c}.exe

Process information

PID
CMD
Path
Indicators
Parent process
1288"C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe" C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe—Explorer.EXE
User:
admin
Company:
uFiler.pro
Integrity Level:
MEDIUM
Description:
uFiler
Exit code:
0
Version:
2020.1.15.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\geometry_dash-285082.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2024"C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe" -a -pipeC:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe
Geometry_Dash-285082.exe
User:
admin
Company:
uFiler.pro
Integrity Level:
HIGH
Description:
uFiler
Version:
2020.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\geometry_dash-285082.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1988"C:\Windows\System32\cmd.exe" /? assoc .ufile=Geometry_Dash-285082.ufileC:\Windows\System32\cmd.exe—Geometry_Dash-285082.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3204"C:\Windows\System32\cmd.exe" /? ftype Geometry_Dash-285082.ufile="C:\Program Files\uFiler\uFiler.exe""%1"C:\Windows\System32\cmd.exe—Geometry_Dash-285082.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3904"C:\Windows\System32\cmd.exe" /? assoc .torrent=Geometry_Dash-285082.torrentC:\Windows\System32\cmd.exe—Geometry_Dash-285082.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2344"C:\Windows\System32\cmd.exe" /? ftype Geometry_Dash-285082.torrent="C:\Program Files\uFiler\uFiler.exe""%1"C:\Windows\System32\cmd.exe—Geometry_Dash-285082.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
828"C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe" -uFileID=285082C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe—Geometry_Dash-285082.exe
User:
admin
Company:
uFiler.pro
Integrity Level:
MEDIUM
Description:
uFiler
Exit code:
0
Version:
2020.1.15.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\geometry_dash-285082.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
2316"C:\Program Files\uFiler\uFiler.exe" -uFileID=285082 -uFileID=285082C:\Program Files\uFiler\uFiler.exe
Geometry_Dash-285082.exe
User:
admin
Company:
uFiler.pro
Integrity Level:
MEDIUM
Description:
uFiler
Version:
2020.1.15.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\ufiler\ufiler.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2940C:\Users\admin\AppData\Local\Temp\yandex_downloader.exe --partner 13027 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y VID=406"C:\Users\admin\AppData\Local\Temp\yandex_downloader.exe
uFiler.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.33
Modules
Images
c:\users\admin\appdata\local\temp\yandex_downloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3700"C:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y VID=406"C:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
yandex_downloader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Software Installer
Exit code:
0
Version:
3.0.5419.0
Modules
Images
c:\users\admin\appdata\local\temp\7f4987fb1a6e43d69e3e94b29eb75926\yandexpacksetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
26 186
Read events
25 550
Write events
611
Delete events
25

Modification events

(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Geometry_Dash-285082.exe
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\uFiler\uFiler
Operation:writeName:DataPath
Value:
C:\ProgramData\uFiler\data\
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Geometry_Dash-285082.exe
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\uFiler_\uFilerClientInfo
Operation:writeName:ClientID
Value:
1647543761-982639898-1540301700
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CLASSES_ROOT\.UFILE
Operation:writeName:(default)
Value:
uFiler
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CLASSES_ROOT\uFiler\shell\open\command
Operation:writeName:(default)
Value:
"C:\Program Files\uFiler\uFiler.exe" "%1"
Executable files
24
Suspicious files
58
Text files
117
Unknown types
45

Dropped files

PID
Process
Filename
Type
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5356BAF0035B9FD8A46F154CBE3DE895binary
MD5:889A65113B0635ED76EA6C1E219167AF
SHA256:387D1DB2DAF74BF485AFE2E1650183199DCB0D01FB74E977BC249CA9A96025A0
2316uFiler.exeC:\Users\admin\AppData\Local\Temp\Tar495D.tmpcat
MD5:D99661D0893A52A0700B8AE68457351A
SHA256:BDD5111162A6FA25682E18FA74E37E676D49CAFCB5B7207E98E5256D1EF0D003
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:082AF5AE9BD1F88B5DE8BFA74FE43F3B
SHA256:B5F9F3200BD33E45862236C59AF9DFBC2794DA5B551F048322B5022EE633804F
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:30C376F2DEC9521B2804FBD8793D4079
SHA256:E6E932D450C420EF96C2759312D6F9DD7F4E282A08D7C7AA1D49D7A434AFB5DC
2316uFiler.exeC:\ProgramData\uFiler\data\ufiles\285082.ufilebinary
MD5:EE1AACC1328125072DBAEC4376F763CF
SHA256:F3037693DF4F8FA6968D855463339A79A1A903AFE15373EC5C6A76E7C4C29BE4
2024Geometry_Dash-285082.exeC:\Program Files\uFiler\uFiler.exeexecutable
MD5:045CD8A6189DD15AD2B8E394F19B32F6
SHA256:702939D19FE783284BA1E80A33490CAF3623A248A6DE5C933A34BCA17D01F5B8
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5356BAF0035B9FD8A46F154CBE3DE895der
MD5:C17F9F9D3A6312E58D2EB88A3120FF4D
SHA256:740CCBAE4273738A1B53F46EFDD42FB0A8111511C9460B79892E6B57902DAE8A
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:AAC57047F9BC2060450D33286A82F99E
SHA256:AE74958282C7438130DF74863AE9A55522006685E5BF30492CD9C0752E61A308
1288Geometry_Dash-285082.exeC:\Users\admin\Desktop\uFiler.lnklnk
MD5:87A258935A89E457A8037D3DE010954B
SHA256:5EEB9A0E6D4F91FCE4B340D87211DD821B4880A98B8B825AF405EC1DA5F4BE96
2316uFiler.exeC:\Users\admin\AppData\Local\Temp\285082.ufilebinary
MD5:EE1AACC1328125072DBAEC4376F763CF
SHA256:F3037693DF4F8FA6968D855463339A79A1A903AFE15373EC5C6A76E7C4C29BE4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
46
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2316
uFiler.exe
GET
302
188.42.196.22:80
http://ufile.cloud/d/bmkg
LU
—
—
malicious
2316
uFiler.exe
GET
302
188.42.196.22:80
http://ufile.cloud/d/d/bmkg
LU
—
—
malicious
2316
uFiler.exe
GET
302
5.45.205.243:80
http://download.yandex.ru/yandex-pack/downloader/downloader.exe
RU
—
—
whitelisted
2940
yandex_downloader.exe
GET
302
5.45.205.244:80
http://download.yandex.ru/yandex-pack/downloader/info.rss
RU
—
—
whitelisted
2940
yandex_downloader.exe
GET
302
5.45.205.242:80
http://downloader.yandex.net/yandex-pack/13027/YandexPackSetup.exe
RU
—
—
whitelisted
2760
lite_installer.exe
GET
302
5.45.205.242:80
http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2356498-406&ui={0fa86c01-6e47-4e96-bd42-cb3c070f94e3}
RU
—
—
whitelisted
2316
uFiler.exe
GET
200
188.42.196.22:80
http://ufile.cloud/api/1.0/statusEx?ufid=285082
LU
binary
96 b
malicious
2316
uFiler.exe
GET
200
23.32.238.67:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQk1LNc3oNypDb05oRIhHa9Fg%3D%3D
US
der
503 b
shared
2316
uFiler.exe
GET
200
188.42.196.4:80
http://node1.cdn.ufile.cloud/ufiles/chg/82/Geometry_Dash_v2.11-bmkg.ufile
LU
binary
1.01 Kb
malicious
2940
yandex_downloader.exe
GET
200
5.45.205.221:80
http://cache-man01i.cdn.yandex.net/downloader.yandex.net/yandex-pack/13027/YandexPackSetup.exe
RU
executable
9.02 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2316
uFiler.exe
188.42.196.4:443
ufile.cloud
Servers.com, Inc.
LU
suspicious
2316
uFiler.exe
188.42.196.22:80
ufile.cloud
Servers.com, Inc.
LU
malicious
2316
uFiler.exe
67.27.157.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2316
uFiler.exe
188.42.196.4:80
ufile.cloud
Servers.com, Inc.
LU
suspicious
2316
uFiler.exe
23.32.238.67:80
r3.o.lencr.org
XO Communications
US
unknown
2316
uFiler.exe
23.37.41.57:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious
2316
uFiler.exe
185.178.208.37:443
thelastgame.ru
Ddos-guard Ltd
RU
unknown
—
—
5.45.205.243:80
download.yandex.ru
YANDEX LLC
RU
whitelisted
2940
yandex_downloader.exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted
2316
uFiler.exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
dht.libtorrent.org
  • 185.157.221.247
suspicious
ufile.cloud
  • 188.42.196.22
  • 188.42.196.4
malicious
node1.cdn.ufile.cloud
  • 188.42.196.4
malicious
thelastgame.ru
  • 185.178.208.37
whitelisted
client.api.ufiler.pro
  • 188.42.196.4
  • 188.42.196.22
malicious
ctldl.windowsupdate.com
  • 67.27.157.254
  • 8.248.115.254
  • 8.253.207.121
  • 67.27.234.126
  • 67.27.158.126
whitelisted
x1.c.lencr.org
  • 23.37.41.57
whitelisted
r3.o.lencr.org
  • 23.32.238.67
  • 23.32.238.51
shared
download.yandex.ru
  • 5.45.205.243
  • 5.45.205.242
  • 5.45.205.245
  • 5.45.205.241
  • 5.45.205.244
whitelisted
cache-man01i.cdn.yandex.net
  • 5.45.205.221
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2316
uFiler.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2940
yandex_downloader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2436
yandex_downloader.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2 ETPRO signatures available at the full report
Process
Message
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
YandexPackSetup.exe
GetSidFromEnumSess(): LsaGetLogonSessionData(0) err = 5
YandexPackSetup.exe
GetSidFromEnumSess(): ProfileImagePath(1) = C:\Users\admin
YandexPackSetup.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1302019708-1500728564-335382590-1000
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Geometry_Dash-285082.exe