File name:

Geometry_Dash-285082.exe

Full analysis: https://app.any.run/tasks/b3b5b2e3-bde4-4095-9245-2e725fbb593b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 22:04:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

045CD8A6189DD15AD2B8E394F19B32F6

SHA1:

3AE29EE703CF7CA59806783BC1CEAA4CBFA0EFE0

SHA256:

702939D19FE783284BA1E80A33490CAF3623A248A6DE5C933A34BCA17D01F5B8

SSDEEP:

196608:R1p0qUlrB8q6W1QmXZTkFkUpmKtX4vGoO85zxkGrs:Rf0ZlsuNZW2vw8Jps

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Geometry_Dash-285082.exe (PID: 2024)
      • yandex_downloader.exe (PID: 2940)
      • MsiExec.exe (PID: 1888)
      • Yandex.exe (PID: 3740)

    • Changes the autorun value in the registry

      • Geometry_Dash-285082.exe (PID: 2024)

    • Loads dropped or rewritten executable

      • uFiler.exe (PID: 2316)
      • Geometry_Dash-285082.exe (PID: 2024)

    • Application was dropped or rewritten from another process

      • yandex_downloader.exe (PID: 2940)
      • yandex_downloader.exe (PID: 2436)
      • YandexPackSetup.exe (PID: 3700)
      • lite_installer.exe (PID: 2760)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)
      • Yandex.exe (PID: 3740)
      • seederexe.exe (PID: 2336)
      • sender.exe (PID: 352)

    • Changes settings of System certificates

      • yandex_downloader.exe (PID: 2940)

    • Actions looks like stealing of personal data

      • lite_installer.exe (PID: 2760)
      • seederexe.exe (PID: 2336)

    • Steals credentials from Web Browsers

      • seederexe.exe (PID: 2336)

  • SUSPICIOUS

    • Creates files in the program directory

      • Geometry_Dash-285082.exe (PID: 2024)
      • uFiler.exe (PID: 2316)

    • Starts CMD.EXE for commands execution

      • Geometry_Dash-285082.exe (PID: 2024)

    • Changes default file association

      • Geometry_Dash-285082.exe (PID: 2024)

    • Checks supported languages

      • cmd.exe (PID: 2344)
      • Geometry_Dash-285082.exe (PID: 828)
      • Geometry_Dash-285082.exe (PID: 2024)
      • Geometry_Dash-285082.exe (PID: 1288)
      • cmd.exe (PID: 3904)
      • cmd.exe (PID: 1988)
      • cmd.exe (PID: 3204)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • YandexPackSetup.exe (PID: 3700)
      • yandex_downloader.exe (PID: 2436)
      • seederexe.exe (PID: 2336)
      • lite_installer.exe (PID: 2760)
      • Yandex.exe (PID: 3740)
      • sender.exe (PID: 352)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Reads the computer name

      • Geometry_Dash-285082.exe (PID: 1288)
      • Geometry_Dash-285082.exe (PID: 2024)
      • Geometry_Dash-285082.exe (PID: 828)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • YandexPackSetup.exe (PID: 3700)
      • seederexe.exe (PID: 2336)
      • lite_installer.exe (PID: 2760)
      • yandex_downloader.exe (PID: 2436)
      • Yandex.exe (PID: 3740)
      • sender.exe (PID: 352)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Application launched itself

      • Geometry_Dash-285082.exe (PID: 1288)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)

    • Creates a software uninstall entry

      • Geometry_Dash-285082.exe (PID: 1288)
      • Yandex.exe (PID: 3740)

    • Creates a directory in Program Files

      • Geometry_Dash-285082.exe (PID: 2024)

    • Executable content was dropped or overwritten

      • Geometry_Dash-285082.exe (PID: 2024)
      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)
      • Yandex.exe (PID: 3740)
      • lite_installer.exe (PID: 2760)

    • Drops a file that was compiled in debug mode

      • Geometry_Dash-285082.exe (PID: 2024)
      • yandex_downloader.exe (PID: 2940)
      • uFiler.exe (PID: 2316)
      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)
      • lite_installer.exe (PID: 2760)
      • Yandex.exe (PID: 3740)

    • Starts itself from another location

      • Geometry_Dash-285082.exe (PID: 828)

    • Reads the date of Windows installation

      • uFiler.exe (PID: 2316)
      • Yandex.exe (PID: 3740)

    • Creates files in the user directory

      • uFiler.exe (PID: 2316)
      • MsiExec.exe (PID: 1888)
      • seederexe.exe (PID: 2336)
      • Yandex.exe (PID: 3740)

    • Executed as Windows Service

      • msiexec.exe (PID: 2104)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2104)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2104)

    • Reads Environment values

      • MsiExec.exe (PID: 1888)

    • Searches for installed software

      • seederexe.exe (PID: 2336)

    • Changes the started page of IE

      • seederexe.exe (PID: 2336)

    • Reads default file associations for system extensions

      • Yandex.exe (PID: 3740)

    • Drops a file with a compile date too recent

      • lite_installer.exe (PID: 2760)

  • INFO

    • Checks Windows Trust Settings

      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • lite_installer.exe (PID: 2760)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Reads settings of System Certificates

      • uFiler.exe (PID: 2316)
      • yandex_downloader.exe (PID: 2940)
      • msiexec.exe (PID: 2104)
      • lite_installer.exe (PID: 2760)
      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)

    • Checks supported languages

      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)

    • Reads the computer name

      • msiexec.exe (PID: 2104)
      • MsiExec.exe (PID: 1888)

    • Manual execution by user

      • {E074A25C-F02E-4AF9-A881-7DD16D5A272C}.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

FileDescription: uFiler
ProgramID: com.embarcadero.uFiler
ProductVersion: 1.0.0
ProductName: uFiler
OriginalFileName: uFiler.exe
FileVersion: 2020.1.15.0
CompanyName: uFiler.pro
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 2020.1.15.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x199bd40
UninitializedDataSize: 17977344
InitializedDataSize: 131072
CodeSize: 8876032
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 2021:06:03 22:05:17+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Jun-2021 20:05:17

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 03-Jun-2021 20:05:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x01125000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x01126000
0x00877000
0x00876200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93355
.rsrc
0x0199D000
0x00020000
0x0001F800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.36005

Imports

KERNEL32.DLL
PSAPI.dll
SHFolder.dll
advapi32.dll
comctl32.dll
comdlg32.dll
d3d9.dll
gdi32.dll
mpr.dll
msvcrt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
18
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start geometry_dash-285082.exe no specs geometry_dash-285082.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs geometry_dash-285082.exe no specs ufiler.exe yandex_downloader.exe yandex_downloader.exe yandexpacksetup.exe msiexec.exe msiexec.exe lite_installer.exe seederexe.exe yandex.exe sender.exe {e074a25c-f02e-4af9-a881-7dd16d5a272c}.exe

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Users\admin\AppData\Local\Temp\7F5F9F89-A4C4-4B98-9169-0FEF6562ECDE\sender.exe --send "/status.xml?clid=2356518-406&uuid=0fa86c01-6e47-4e96-bd42-cb3c070f94e3&vnt=Windows 7x32&file-no=6%0A10%0A11%0A12%0A13%0A15%0A16%0A17%0A18%0A20%0A21%0A22%0A24%0A25%0A38%0A40%0A42%0A43%0A45%0A58%0A61%0A89%0A102%0A103%0A106%0A111%0A123%0A124%0A125%0A129%0A"C:\Users\admin\AppData\Local\Temp\7F5F9F89-A4C4-4B98-9169-0FEF6562ECDE\sender.exe
seederexe.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Yandex Statistics
Exit code:
0
Version:
0.0.2.14
Modules
Images
c:\users\admin\appdata\local\temp\7f5f9f89-a4c4-4b98-9169-0fef6562ecde\sender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\webio.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
828"C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe" -uFileID=285082C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe—Geometry_Dash-285082.exe
User:
admin
Company:
uFiler.pro
Integrity Level:
MEDIUM
Description:
uFiler
Exit code:
0
Version:
2020.1.15.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\geometry_dash-285082.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
1288"C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe" C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe—Explorer.EXE
User:
admin
Company:
uFiler.pro
Integrity Level:
MEDIUM
Description:
uFiler
Exit code:
0
Version:
2020.1.15.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\geometry_dash-285082.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1888C:\Windows\system32\MsiExec.exe -Embedding 74764D0352A3AA1B20FC86A8630E29D9C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1988"C:\Windows\System32\cmd.exe" /? assoc .ufile=Geometry_Dash-285082.ufileC:\Windows\System32\cmd.exe—Geometry_Dash-285082.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2024"C:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe" -a -pipeC:\Users\admin\AppData\Local\Temp\Geometry_Dash-285082.exe
Geometry_Dash-285082.exe
User:
admin
Company:
uFiler.pro
Integrity Level:
HIGH
Description:
uFiler
Exit code:
0
Version:
2020.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\geometry_dash-285082.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2104C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2316"C:\Program Files\uFiler\uFiler.exe" -uFileID=285082 -uFileID=285082C:\Program Files\uFiler\uFiler.exe
Geometry_Dash-285082.exe
User:
admin
Company:
uFiler.pro
Integrity Level:
MEDIUM
Description:
uFiler
Exit code:
0
Version:
2020.1.15.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\ufiler\ufiler.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2336"C:\Users\admin\AppData\Local\Temp\D7177BC5-069D-44EE-9258-ABA2F4B680FA\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\admin\AppData\Local\Temp\7F5F9F89-A4C4-4B98-9169-0FEF6562ECDE\sender.exe" "--is_elevated=no" "--ui_level=2" "--good_token=x" "--no_opera=n"C:\Users\admin\AppData\Local\Temp\D7177BC5-069D-44EE-9258-ABA2F4B680FA\seederexe.exe
MsiExec.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Browser Integration Module
Exit code:
0
Version:
3.7.3.129
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\d7177bc5-069d-44ee-9258-aba2f4b680fa\seederexe.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2344"C:\Windows\System32\cmd.exe" /? ftype Geometry_Dash-285082.torrent="C:\Program Files\uFiler\uFiler.exe""%1"C:\Windows\System32\cmd.exe—Geometry_Dash-285082.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
26 186
Read events
25 550
Write events
611
Delete events
25

Modification events

(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Geometry_Dash-285082.exe
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\uFiler\uFiler
Operation:writeName:DataPath
Value:
C:\ProgramData\uFiler\data\
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1288) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Geometry_Dash-285082.exe
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CURRENT_USER\Software\uFiler_\uFilerClientInfo
Operation:writeName:ClientID
Value:
1647543761-982639898-1540301700
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CLASSES_ROOT\.UFILE
Operation:writeName:(default)
Value:
uFiler
(PID) Process:(2024) Geometry_Dash-285082.exeKey:HKEY_CLASSES_ROOT\uFiler\shell\open\command
Operation:writeName:(default)
Value:
"C:\Program Files\uFiler\uFiler.exe" "%1"
Executable files
24
Suspicious files
58
Text files
117
Unknown types
45

Dropped files

PID
Process
Filename
Type
2024Geometry_Dash-285082.exeC:\Program Files\uFiler\uFiler.exeexecutable
MD5:—
SHA256:—
2316uFiler.exeC:\ProgramData\uFiler\data\uFiler.db-journalgmc
MD5:—
SHA256:—
2316uFiler.exeC:\Users\admin\AppData\Local\Temp\285082.ufilebinary
MD5:—
SHA256:—
1288Geometry_Dash-285082.exeC:\Users\admin\Desktop\uFiler.lnklnk
MD5:—
SHA256:—
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5356BAF0035B9FD8A46F154CBE3DE895der
MD5:—
SHA256:—
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2316uFiler.exeC:\ProgramData\uFiler\data\ufiles\285082.ufilebinary
MD5:—
SHA256:—
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
2316uFiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5356BAF0035B9FD8A46F154CBE3DE895binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
46
DNS requests
31
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2316
uFiler.exe
GET
302
5.45.205.243:80
http://download.yandex.ru/yandex-pack/downloader/downloader.exe
RU
—
—
whitelisted
2316
uFiler.exe
GET
302
188.42.196.22:80
http://ufile.cloud/d/d/bmkg
LU
—
—
malicious
2940
yandex_downloader.exe
GET
302
5.45.205.244:80
http://download.yandex.ru/yandex-pack/downloader/info.rss
RU
—
—
whitelisted
2760
lite_installer.exe
GET
302
5.45.205.242:80
http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2356498-406&ui={0fa86c01-6e47-4e96-bd42-cb3c070f94e3}
RU
—
—
whitelisted
2316
uFiler.exe
GET
302
188.42.196.22:80
http://ufile.cloud/d/bmkg
LU
—
—
malicious
2316
uFiler.exe
GET
200
188.42.196.22:80
http://ufile.cloud/api/1.0/statusEx?ufid=285082
LU
binary
96 b
malicious
2316
uFiler.exe
GET
200
188.42.196.4:80
http://node1.cdn.ufile.cloud/ufiles/chg/82/Geometry_Dash_v2.11-bmkg.ufile
LU
binary
1.01 Kb
malicious
2940
yandex_downloader.exe
GET
200
5.45.205.221:80
http://cache-man01i.cdn.yandex.net/downloader.yandex.net/yandex-pack/13027/YandexPackSetup.exe
RU
executable
9.02 Mb
whitelisted
2316
uFiler.exe
GET
200
23.32.238.67:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQk1LNc3oNypDb05oRIhHa9Fg%3D%3D
US
der
503 b
shared
2316
uFiler.exe
GET
200
23.37.41.57:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2316
uFiler.exe
188.42.196.22:80
ufile.cloud
Servers.com, Inc.
LU
malicious
2316
uFiler.exe
188.42.196.4:80
ufile.cloud
Servers.com, Inc.
LU
suspicious
2316
uFiler.exe
23.37.41.57:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious
—
—
5.45.205.243:80
download.yandex.ru
YANDEX LLC
RU
whitelisted
2316
uFiler.exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted
2940
yandex_downloader.exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted
2940
yandex_downloader.exe
5.45.205.244:80
download.yandex.ru
YANDEX LLC
RU
whitelisted
2940
yandex_downloader.exe
5.45.205.242:80
download.yandex.ru
YANDEX LLC
RU
whitelisted
2436
yandex_downloader.exe
87.250.251.14:80
clck.yandex.ru
YANDEX LLC
RU
whitelisted
—
—
104.18.20.226:80
secure.globalsign.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
dht.libtorrent.org
  • 185.157.221.247
suspicious
ufile.cloud
  • 188.42.196.22
  • 188.42.196.4
malicious
node1.cdn.ufile.cloud
  • 188.42.196.4
malicious
thelastgame.ru
  • 185.178.208.37
whitelisted
client.api.ufiler.pro
  • 188.42.196.4
  • 188.42.196.22
malicious
ctldl.windowsupdate.com
  • 67.27.157.254
  • 8.248.115.254
  • 8.253.207.121
  • 67.27.234.126
  • 67.27.158.126
whitelisted
x1.c.lencr.org
  • 23.37.41.57
whitelisted
r3.o.lencr.org
  • 23.32.238.67
  • 23.32.238.51
shared
download.yandex.ru
  • 5.45.205.243
  • 5.45.205.242
  • 5.45.205.245
  • 5.45.205.241
  • 5.45.205.244
whitelisted
cache-man01i.cdn.yandex.net
  • 5.45.205.221
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2316
uFiler.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2316
uFiler.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2940
yandex_downloader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2436
yandex_downloader.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2 ETPRO signatures available at the full report
Process
Message
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
YandexPackSetup.exe
GetSidFromEnumSess(): LsaGetLogonSessionData(0) err = 5
YandexPackSetup.exe
GetSidFromEnumSess(): ProfileImagePath(1) = C:\Users\admin
YandexPackSetup.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1302019708-1500728564-335382590-1000
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Geometry_Dash-285082.exe