File name:

Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe

Full analysis: https://app.any.run/tasks/6b4de766-9c23-4078-b539-1aa83e3bbe18
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 27, 2024, 07:23:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
pua
pup
not-a-virus
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AF90D321179FF395EEA8F440CC7232FA

SHA1:

4186B6D82CCEEDFA06A753B1E37D8E070C3FC2B9

SHA256:

80729F5237AC4B69D0ED4B947F44BA97C582367B834EE453E1C9478C38649E07

SSDEEP:

98304:6gWmxDbUQ+ysxZmA4Kgsv2auUStZDHLyhV2syJlW9HBrk7HX4OAwXmb6nsbVX5ao:c8KIQ9OXg1ta7w4snPM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3520)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 2076)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • downloader.exe (PID: 3696)
      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 1596)
      • Yandex.exe (PID: 2832)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • Instup.exe (PID: 2676)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • lite_installer.exe (PID: 3840)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3600)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3348)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • driverscanner.exe (PID: 1832)
      • driverscanner.tmp (PID: 2588)
      • msiexec.exe (PID: 2920)
      • lite_installer.exe (PID: 2512)

    • Actions looks like stealing of personal data

      • lite_installer.exe (PID: 3840)
      • seederexe.exe (PID: 3316)
      • lite_installer.exe (PID: 2512)
      • seederexe.exe (PID: 3884)

    • Steals credentials from Web Browsers

      • seederexe.exe (PID: 3316)
      • seederexe.exe (PID: 3884)

    • Changes the autorun value in the registry

      • instup.exe (PID: 3592)

    • Connects to the CnC server

      • driverscanner.tmp (PID: 2588)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3520)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 2076)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • downloader.exe (PID: 3696)
      • Yandex.exe (PID: 2832)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • Instup.exe (PID: 2676)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3600)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3348)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • driverscanner.tmp (PID: 2588)
      • driverscanner.exe (PID: 1832)

    • Reads the Windows owner or organization settings

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • msiexec.exe (PID: 1596)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • driverscanner.tmp (PID: 2588)

    • Access to an unwanted program domain was detected

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • driverscanner.tmp (PID: 2588)

    • Reads the Internet Settings

      • downloader.exe (PID: 3696)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • lite_installer.exe (PID: 3840)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • lite_installer.exe (PID: 2512)
      • driverscanner.tmp (PID: 2588)
      • driverscanner.exe (PID: 3904)
      • dsmonitor.exe (PID: 2792)

    • Reads security settings of Internet Explorer

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • downloader.exe (PID: 3696)
      • lite_installer.exe (PID: 3840)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • lite_installer.exe (PID: 2512)
      • driverscanner.exe (PID: 3904)

    • Process drops legitimate windows executable

      • downloader.exe (PID: 3696)
      • driverscanner.tmp (PID: 2588)

    • Checks Windows Trust Settings

      • downloader.exe (PID: 3696)
      • msiexec.exe (PID: 1596)
      • lite_installer.exe (PID: 3840)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • lite_installer.exe (PID: 2512)

    • Reads settings of System Certificates

      • downloader.exe (PID: 3696)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • lite_installer.exe (PID: 3840)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • lite_installer.exe (PID: 2512)

    • Adds/modifies Windows certificates

      • downloader.exe (PID: 3696)
      • msiexec.exe (PID: 1596)

    • Starts a Microsoft application from unusual location

      • YandexPackSetup.exe (PID: 3056)
      • YandexPackSetup.exe (PID: 3844)

    • Process requests binary or script from the Internet

      • downloader.exe (PID: 3696)
      • lite_installer.exe (PID: 3840)
      • downloader.exe (PID: 3972)
      • lite_installer.exe (PID: 2512)

    • Potential Corporate Privacy Violation

      • downloader.exe (PID: 3696)
      • lite_installer.exe (PID: 3840)
      • lite_installer.exe (PID: 2512)
      • driverscanner.exe (PID: 3904)

    • Application launched itself

      • downloader.exe (PID: 3696)
      • downloader.exe (PID: 3972)

    • Reads Mozilla Firefox installation path

      • seederexe.exe (PID: 3316)
      • seederexe.exe (PID: 3884)

    • Changes the Home page of Internet Explorer

      • seederexe.exe (PID: 3316)

    • Changes the title of the Internet Explorer window

      • seederexe.exe (PID: 3316)

    • Creates a software uninstall entry

      • Yandex.exe (PID: 2832)
      • Yandex.exe (PID: 3652)

    • Reads the date of Windows installation

      • Yandex.exe (PID: 2832)
      • Yandex.exe (PID: 3652)

    • The process verifies whether the antivirus software is installed

      • instup.exe (PID: 3592)

    • Starts itself from another location

      • Instup.exe (PID: 2676)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4092)

    • The process drops C-runtime libraries

      • driverscanner.tmp (PID: 2588)

    • Searches for installed software

      • dllhost.exe (PID: 3716)
      • driverscanner.tmp (PID: 2588)

    • The process executes via Task Scheduler

      • dsmonitor.exe (PID: 1488)

    • Reads Microsoft Outlook installation path

      • driverscanner.exe (PID: 3904)

    • Reads Internet Explorer settings

      • driverscanner.exe (PID: 3904)

  • INFO

    • Checks supported languages

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3520)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 3252)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 2076)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • YandexPackSetup.exe (PID: 3056)
      • downloader.exe (PID: 3696)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • msiexec.exe (PID: 1596)
      • downloader.exe (PID: 964)
      • lite_installer.exe (PID: 3840)
      • seederexe.exe (PID: 3316)
      • msiexec.exe (PID: 2544)
      • Yandex.exe (PID: 2832)
      • sender.exe (PID: 2128)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • Instup.exe (PID: 2676)
      • sbr.exe (PID: 2664)
      • instup.exe (PID: 3592)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3600)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3348)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 3096)
      • downloader.exe (PID: 3972)
      • YandexPackSetup.exe (PID: 3844)
      • downloader.exe (PID: 2420)
      • driverscanner.exe (PID: 1832)
      • driverscanner.tmp (PID: 2588)
      • msiexec.exe (PID: 2920)
      • lite_installer.exe (PID: 2512)
      • Yandex.exe (PID: 3652)
      • seederexe.exe (PID: 3884)
      • sender.exe (PID: 2028)
      • ds_move_serial.exe (PID: 2604)
      • dsmonitor.exe (PID: 2792)
      • driverscanner.exe (PID: 3904)
      • dsmonitor.exe (PID: 1488)
      • {EC94EFA1-3666-4FA1-941F-939CE0287796}.exe (PID: 2464)

    • Create files in a temporary directory

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3520)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 2076)
      • downloader.exe (PID: 3696)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • downloader.exe (PID: 964)
      • YandexPackSetup.exe (PID: 3056)
      • msiexec.exe (PID: 1596)
      • lite_installer.exe (PID: 3840)
      • seederexe.exe (PID: 3316)
      • msiexec.exe (PID: 2544)
      • sender.exe (PID: 2128)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3600)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3348)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • downloader.exe (PID: 3972)
      • driverscanner.exe (PID: 1832)
      • downloader.exe (PID: 2420)
      • YandexPackSetup.exe (PID: 3844)
      • driverscanner.tmp (PID: 2588)
      • msiexec.exe (PID: 2920)
      • lite_installer.exe (PID: 2512)
      • seederexe.exe (PID: 3884)
      • sender.exe (PID: 2028)

    • Reads the computer name

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 3252)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • YandexPackSetup.exe (PID: 3056)
      • downloader.exe (PID: 3696)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • msiexec.exe (PID: 1596)
      • lite_installer.exe (PID: 3840)
      • msiexec.exe (PID: 2544)
      • downloader.exe (PID: 964)
      • Yandex.exe (PID: 2832)
      • seederexe.exe (PID: 3316)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • sender.exe (PID: 2128)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 3096)
      • downloader.exe (PID: 3972)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • YandexPackSetup.exe (PID: 3844)
      • driverscanner.tmp (PID: 2588)
      • msiexec.exe (PID: 2920)
      • lite_installer.exe (PID: 2512)
      • seederexe.exe (PID: 3884)
      • downloader.exe (PID: 2420)
      • ds_move_serial.exe (PID: 2604)
      • sender.exe (PID: 2028)
      • Yandex.exe (PID: 3652)
      • dsmonitor.exe (PID: 2792)
      • driverscanner.exe (PID: 3904)
      • dsmonitor.exe (PID: 1488)

    • Checks proxy server information

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • downloader.exe (PID: 3696)
      • lite_installer.exe (PID: 3840)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • lite_installer.exe (PID: 2512)
      • dsmonitor.exe (PID: 2792)
      • driverscanner.exe (PID: 3904)

    • Reads the machine GUID from the registry

      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 2348)
      • downloader.exe (PID: 3696)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • msiexec.exe (PID: 1596)
      • YandexPackSetup.exe (PID: 3056)
      • lite_installer.exe (PID: 3840)
      • msiexec.exe (PID: 2544)
      • seederexe.exe (PID: 3316)
      • Yandex.exe (PID: 2832)
      • sender.exe (PID: 2128)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp (PID: 680)
      • YandexPackSetup.exe (PID: 3844)
      • msiexec.exe (PID: 2920)
      • lite_installer.exe (PID: 2512)
      • driverscanner.tmp (PID: 2588)
      • seederexe.exe (PID: 3884)
      • Yandex.exe (PID: 3652)
      • sender.exe (PID: 2028)
      • ds_move_serial.exe (PID: 2604)
      • dsmonitor.exe (PID: 2792)
      • driverscanner.exe (PID: 3904)
      • dsmonitor.exe (PID: 1488)

    • Reads the software policy settings

      • downloader.exe (PID: 3696)
      • avast_free_antivirus_setup_online.exe (PID: 3068)
      • msiexec.exe (PID: 1596)
      • Instup.exe (PID: 2676)
      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • instup.exe (PID: 3592)
      • lite_installer.exe (PID: 3840)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • lite_installer.exe (PID: 2512)

    • Creates files or folders in the user directory

      • downloader.exe (PID: 3696)
      • msiexec.exe (PID: 2544)
      • lite_installer.exe (PID: 3840)
      • msiexec.exe (PID: 1596)
      • seederexe.exe (PID: 3316)
      • Yandex.exe (PID: 2832)
      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • downloader.exe (PID: 3972)
      • lite_installer.exe (PID: 2512)
      • seederexe.exe (PID: 3884)
      • driverscanner.tmp (PID: 2588)
      • Yandex.exe (PID: 3652)
      • dsmonitor.exe (PID: 2792)
      • driverscanner.exe (PID: 3904)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1596)
      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 2920)

    • Reads Environment values

      • msiexec.exe (PID: 2544)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • msiexec.exe (PID: 2920)
      • ds_move_serial.exe (PID: 2604)
      • dsmonitor.exe (PID: 2792)
      • driverscanner.exe (PID: 3904)
      • dsmonitor.exe (PID: 1488)

    • Process checks computer location settings

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 2920)

    • Application launched itself

      • msiexec.exe (PID: 1596)
      • iexplore.exe (PID: 1044)
      • iexplore.exe (PID: 2396)

    • Creates files in the program directory

      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • driverscanner.tmp (PID: 2588)
      • driverscanner.exe (PID: 3904)

    • Reads CPU info

      • avast_free_antivirus_setup_online.exe (PID: 2296)
      • Instup.exe (PID: 2676)
      • instup.exe (PID: 3592)
      • driverscanner.exe (PID: 3904)

    • Manual execution by a user

      • {11A7D5AC-B623-401A-A104-1762FB8830FD}.exe (PID: 3724)
      • iexplore.exe (PID: 2396)
      • iexplore.exe (PID: 1044)
      • Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe (PID: 3600)
      • {EC94EFA1-3666-4FA1-941F-939CE0287796}.exe (PID: 2464)

    • Dropped object may contain TOR URL's

      • Instup.exe (PID: 2676)

    • Creates a software uninstall entry

      • driverscanner.tmp (PID: 2588)

    • Reads product name

      • driverscanner.exe (PID: 3904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:06 14:39:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 179712
UninitializedDataSize: -
EntryPoint: 0x117dc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: appset.me
FileDescription: Uniblue DriverScanner Setup
FileVersion:
LegalCopyright:
ProductName: Uniblue DriverScanner
ProductVersion: 0.0.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
45
Malicious processes
27
Suspicious processes
1

Behavior graph

Click at the process to see the details
start hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp no specs hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp downloader.exe yandexpacksetup.exe downloader.exe avast_free_antivirus_setup_online.exe msiexec.exe msiexec.exe lite_installer.exe seederexe.exe yandex.exe sender.exe avast_free_antivirus_setup_online.exe instup.exe instup.exe sbr.exe no specs {11a7d5ac-b623-401a-a104-1762fb8830fd}.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp no specs hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp downloader.exe yandexpacksetup.exe downloader.exe driverscanner.exe driverscanner.tmp msiexec.exe lite_installer.exe seederexe.exe yandex.exe no specs vssvc.exe no specs sender.exe SPPSurrogate no specs ds_move_serial.exe dsmonitor.exe driverscanner.exe dsmonitor.exe {ec94efa1-3666-4fa1-941f-939ce0287796}.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\AppData\Local\Temp\is-KKRGJ.tmp\Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp" /SL5="$50362,8726424,247296,C:\Users\admin\Desktop\Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe" /SPAWNWND=$302E2 /NOTIFYWND=$402C4 C:\Users\admin\AppData\Local\Temp\is-KKRGJ.tmp\Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-kkrgj.tmp\hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
880"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1044 CREDAT:3347725 APPID:Microsoft.Website.2AE68B04.23AF42CA /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
964C:\Users\admin\AppData\Local\Temp\downloader.exe --stat dwnldr/p=7053/cnt=0/dt=6/ct=1/rt=0 --dh 1436 --st 1719473049C:\Users\admin\AppData\Local\Temp\downloader.exe
downloader.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.32
Modules
Images
c:\users\admin\appdata\local\temp\downloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1044"C:\Program Files\Internet Explorer\iexplore.exe" -w "C:\Users\admin\Desktop\Яндекс.website" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1488"C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe" C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe
taskeng.exe
User:
admin
Company:
Uniblue Systems Ltd
Integrity Level:
HIGH
Description:
Uniblue DriverScanner Monitor
Version:
4.1.1.1
Modules
Images
c:\program files\uniblue\driverscanner\dsmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
1596C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1832"C:\Users\admin\AppData\Local\Temp\is-CJEDT.tmp\driverscanner.exe" C:\Users\admin\AppData\Local\Temp\is-CJEDT.tmp\driverscanner.exe
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
User:
admin
Company:
Uniblue Systems Ltd
Integrity Level:
HIGH
Description:
DriverScanner Setup
Exit code:
0
Version:
4.1.1.1
Modules
Images
c:\users\admin\appdata\local\temp\is-cjedt.tmp\driverscanner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2028C:\Users\admin\AppData\Local\Temp\D8CD6BC8-AA5E-431A-BC4C-CBE9ACB72FAB\sender.exe --send "/status.xml?clid=2313438-3&uuid=99555ae8-FF28-4974-8D86-1EA4E4F0df91&vnt=Windows 7x32&file-no=8%0A13%0A15%0A18%0A25%0A42%0A45%0A49%0A50%0A57%0A61%0A103%0A111%0A123%0A124%0A125%0A"C:\Users\admin\AppData\Local\Temp\D8CD6BC8-AA5E-431A-BC4C-CBE9ACB72FAB\sender.exe
seederexe.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Yandex Statistics
Exit code:
0
Version:
0.0.2.14
Modules
Images
c:\users\admin\appdata\local\temp\d8cd6bc8-aa5e-431a-bc4c-cbe9acb72fab\sender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2076"C:\Users\admin\Desktop\Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe" /SPAWNWND=$4010A /NOTIFYWND=$B016A C:\Users\admin\Desktop\Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
User:
admin
Company:
appset.me
Integrity Level:
HIGH
Description:
Uniblue DriverScanner Setup
Version:
Modules
Images
c:\users\admin\desktop\hoax.win32.speedupmypc.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2128C:\Users\admin\AppData\Local\Temp\1071AB23-7805-4D4A-8404-8614C8B41A4A\sender.exe --send "/status.xml?clid=2313438-3&uuid=99555ae8-FF28-4974-8D86-1EA4E4F0df91&vnt=Windows 7x32&file-no=8%0A10%0A11%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A24%0A25%0A40%0A42%0A45%0A50%0A57%0A61%0A89%0A103%0A111%0A123%0A124%0A125%0A129%0A"C:\Users\admin\AppData\Local\Temp\1071AB23-7805-4D4A-8404-8614C8B41A4A\sender.exe
seederexe.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Yandex Statistics
Exit code:
0
Version:
0.0.2.14
Modules
Images
c:\users\admin\appdata\local\temp\1071ab23-7805-4d4a-8404-8614c8b41a4a\sender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
130 261
Read events
125 923
Write events
4 166
Delete events
172

Modification events

(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
2C0900007ADDCCF162C8DA01
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
12563859FB8FCE2BE90A30BE080ADA01C6E83781BABF353C5C2AFB6190569E29
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2348) Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
138
Suspicious files
252
Text files
474
Unknown types
7

Dropped files

PID
Process
Filename
Type
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\botva2.dllexecutable
MD5:EF899FA243C07B7B82B3A45F6EC36771
SHA256:DA7D0368712EE419952EB2640A65A7F24E39FB7872442ED4D2EE847EC4CFDE77
3520Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exeC:\Users\admin\AppData\Local\Temp\is-LL88E.tmp\Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpexecutable
MD5:030FF307247E27693F139602B2B844CE
SHA256:EAAD488AD85FEB448EA788243406CB598B91A2E3512A808F43B3EBBCB6308D92
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\AppsetOfferImage.pngimage
MD5:B4CE10D2BACBD8689F4000DAB70582B2
SHA256:832A4A89357D6E195D7D7A442393459348F9D83476F2FDA4C50EF1762D75B3A9
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\avast_free_antivirus_setup_online.exeexecutable
MD5:8078AEB5AFEFAE19356709EC118599C3
SHA256:3DEAAF71EF6F9BE574913006500DC34F156D6334D619FDAE9DB02B0C77F2C1E3
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\driverscanner.exeexecutable
MD5:6DD862ACF1ABE210DEA0E6E345E59E19
SHA256:F834401AF4FE7F2052E35EBD6F616B97ECBDAA0181BD486442E6DFCFE3FA149D
3056YandexPackSetup.exeC:\Users\admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi —
MD5:—
SHA256:—
1596msiexec.exeC:\Windows\Installer\54d9a.msi —
MD5:—
SHA256:—
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\NativeUID.dllexecutable
MD5:D47E7649FC7B9BD91C7D091FDE71B889
SHA256:A2583DBFD24D9061954DC185D1D5E43CFF71CCC1342C6E87D7C349B70E8FA9AB
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\Ya_distr_342x422.pngimage
MD5:B273649B75D640CCD6921E22F7016566
SHA256:632BCE31329FB202B24A76CA7CC15264BD88562DE9B41783D9CB61154C6D78BB
2348Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmpC:\Users\admin\AppData\Local\Temp\is-2BITV.tmp\OfferImage.pngimage
MD5:EFF3D5AB0229C6345C59491950E41EA8
SHA256:1CEC4E985448262E535521D5F3486444C44AC07ED8F19330092C93E3B0417512
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
158
DNS requests
114
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3696
downloader.exe
GET
200
5.45.247.52:80
http://cachev2-ams02.cdn.yandex.net/downloader.yandex.net/yandex-pack/downloader/info.rss?lid=300
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
3696
downloader.exe
GET
302
5.45.205.241:80
http://downloader.yandex.net/yandex-pack/downloader/info.rss
unknown
—
—
unknown
2348
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
GET
202
188.42.30.244:80
http://stat.offerbox.io/download/3/{B8936F92-BB4B-4CFE-A2CA-2152CDD6A40D}/4E3014F88A1776A95D57E2AE3211A742FF35E455C4BA364784/1/0
unknown
—
—
unknown
1372
svchost.exe
GET
304
23.50.131.196:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3696
downloader.exe
GET
302
5.45.205.241:80
http://downloader.yandex.net/yandex-pack/7053/YandexPackSetup.exe
unknown
—
—
unknown
2348
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
GET
202
188.42.30.244:80
http://stat.offerbox.io/download/3/{B8936F92-BB4B-4CFE-A2CA-2152CDD6A40D}/4E3014F88A1776A95D57E2AE3211A742FF35E455C4BA364784/4/1
unknown
—
—
unknown
3068
avast_free_antivirus_setup_online.exe
GET
302
23.48.23.42:80
http://files.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
unknown
—
—
unknown
3840
lite_installer.exe
GET
200
213.180.193.14:80
http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=0.winapi_download/ui=99555ae8-FF28-4974-8D86-1EA4E4F0df91/clid1=2313418-3/dt=0/ds=0/bits=7_5_7601_17514/bver=0_0_0_0/prod_version=1_0_1_9/result=ok/*
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
239.255.255.250:3702
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2348
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.tmp
188.42.30.244:80
stat.offerbox.io
United Network LLC
LU
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3696
downloader.exe
5.45.205.241:80
downloader.yandex.net
YANDEX LLC
RU
whitelisted
3696
downloader.exe
5.45.247.52:80
cachev2-ams02.cdn.yandex.net
YANDEX LLC
RU
unknown
1372
svchost.exe
23.50.131.196:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
stat.offerbox.io
  • 188.42.30.244
malicious
downloader.yandex.net
  • 5.45.205.241
  • 5.45.205.245
  • 5.45.205.244
  • 5.45.205.242
  • 5.45.205.243
whitelisted
cachev2-ams02.cdn.yandex.net
  • 5.45.247.52
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.196
  • 23.50.131.200
  • 23.50.131.213
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.google-analytics.com
  • 142.250.185.110
  • 142.250.74.206
whitelisted
v7event.stats.avast.com
  • 34.117.223.223
whitelisted
files.avast.com
  • 23.48.23.42
  • 23.48.23.43
whitelisted

Threats

PID
Process
Class
Message
3696
downloader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3840
lite_installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3840
lite_installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
964
downloader.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2512
lite_installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2512
lite_installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2420
downloader.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
3904
driverscanner.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
3904
driverscanner.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
12 ETPRO signatures available at the full report
Process
Message
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetSidFromEnumSess(): i = 0 : szUserName = Administrator, szDomain = USER-PC, dwSessionId = 0
YandexPackSetup.exe
GetSidFromEnumSess(): i = 1 : szUserName = admin, szDomain = USER-PC, dwSessionId = 0
YandexPackSetup.exe
GetSidFromEnumSess(): ProfileImagePath(2) = C:\Users\admin
YandexPackSetup.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1302019708-1500728564-335382590-1000
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Hoax.Win32.SpeedUpMyPC.gen-80729f5237ac4b69d0ed4b947f44ba97c582367b834ee453e1c9478c38649e07.exe