File name:

SecuriteInfo.com.Trojan.Inject5.6971.18861.4102

Full analysis: https://app.any.run/tasks/0e7e1537-28c8-40c7-8648-32bd6b587f76
Verdict: Malicious activity
Analysis date: August 11, 2024, 14:19:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DC849F6C2BC4C70D7D9B6710179BB689

SHA1:

DA66C75FCC16BAF4D3B5EAD360E4371E7481AC2C

SHA256:

90F033F2FFAE0AD8A43CEFB0E273ED33B54497BA65C19E0173E4CC7E6DEC1757

SSDEEP:

98304:imzr1kid/fC7dvIu1UYzQ0Q6d/4xsutJV7lVnk4eNa0DoUXkmCdcqWLb1klQmMcj:nbkUNWS0C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)
      • itubego_v8.0.0_x64.exe (PID: 3372)
      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Reads the Windows owner or organization settings

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Executable content was dropped or overwritten

      • itubego_v8.0.0_x64.tmp (PID: 4604)
      • itubego_v8.0.0_x64.exe (PID: 3372)

    • Reads security settings of Internet Explorer

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Reads the date of Windows installation

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Starts CMD.EXE for commands execution

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Get information on the list of running processes

      • itubego_v8.0.0_x64.tmp (PID: 4604)
      • cmd.exe (PID: 4292)

    • Drops 7-zip archiver for unpacking

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 4292)

    • Process drops legitimate windows executable

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • The process drops C-runtime libraries

      • itubego_v8.0.0_x64.tmp (PID: 4604)

  • INFO

    • Checks proxy server information

      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)
      • itubegow.exe (PID: 5328)

    • Checks supported languages

      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)
      • itubego_v8.0.0_x64.tmp (PID: 4604)
      • itubegow.exe (PID: 5328)
      • itubego_v8.0.0_x64.exe (PID: 3372)

    • Reads the computer name

      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)
      • itubego_v8.0.0_x64.tmp (PID: 4604)
      • itubegow.exe (PID: 5328)

    • Create files in a temporary directory

      • itubego_v8.0.0_x64.tmp (PID: 4604)
      • itubego_v8.0.0_x64.exe (PID: 3372)
      • itubegow.exe (PID: 5328)
      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)
      • itubegow.exe (PID: 5328)

    • Process checks computer location settings

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Creates files in the program directory

      • itubego_v8.0.0_x64.tmp (PID: 4604)
      • itubegow.exe (PID: 5328)
      • SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe (PID: 6480)

    • Creates a software uninstall entry

      • itubego_v8.0.0_x64.tmp (PID: 4604)

    • Creates files or folders in the user directory

      • itubegow.exe (PID: 5328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:17 07:29:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 2227200
InitializedDataSize: 1053696
UninitializedDataSize: -
EntryPoint: 0x1dc0e3
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 24.7.12.1
ProductVersionNumber: 4.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileDescription: iTubeGo
FileVersion: 24.7.12.1
LegalCopyright: Copyright (c) 2024 iTubeGo Studio. All rights reserved.
ProductName: iTubeGo
ProductVersion: 4.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.trojan.inject5.6971.18861.4102.exe itubego_v8.0.0_x64.exe itubego_v8.0.0_x64.tmp cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs itubegow.exe securiteinfo.com.trojan.inject5.6971.18861.4102.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Users\admin\AppData\Local\Temp\\tmp123_downloader\download\itubego_v8.0.0_x64.exe" /verysilent /wait_run /DIR="C:\Program Files\iTubeGo" /LANG=english C:\Users\admin\AppData\Local\Temp\tmp123_downloader\download\itubego_v8.0.0_x64.exe
SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe
User:
admin
Company:
LuckyDog Software, Inc.
Integrity Level:
HIGH
Description:
iTubeGo Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\tmp123_downloader\download\itubego_v8.0.0_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4292"C:\WINDOWS\system32\cmd.exe" /c tasklist | findstr "itubegow.exe" > "C:\Users\admin\AppData\Local\Temp\findProcessRes.txt"C:\Windows\SysWOW64\cmd.exe—itubego_v8.0.0_x64.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4604"C:\Users\admin\AppData\Local\Temp\is-MA11I.tmp\itubego_v8.0.0_x64.tmp" /SL5="$B0040,131159345,784384,C:\Users\admin\AppData\Local\Temp\tmp123_downloader\download\itubego_v8.0.0_x64.exe" /verysilent /wait_run /DIR="C:\Program Files\iTubeGo" /LANG=english C:\Users\admin\AppData\Local\Temp\is-MA11I.tmp\itubego_v8.0.0_x64.tmp
itubego_v8.0.0_x64.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ma11i.tmp\itubego_v8.0.0_x64.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
5300findstr "itubegow.exe" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5328"C:\Program Files\iTubeGo\itubegow.exe"C:\Program Files\iTubeGo\itubegow.exe
SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe
User:
admin
Integrity Level:
HIGH
Description:
iTubeGo
Version:
8.0.0.0
Modules
Images
c:\program files\itubego\itubegow.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6260\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6432"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
iTubeGo
Exit code:
3221226540
Version:
24.7.12.1
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.trojan.inject5.6971.18861.4102.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6480"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
iTubeGo
Exit code:
0
Version:
24.7.12.1
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.trojan.inject5.6971.18861.4102.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7048tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
4 938
Read events
4 833
Write events
99
Delete events
6

Modification events

(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
FC11000066DB48B9F9EBDA01
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8BB94CE61808C1EEBDE8A336B4D52DEFF9912F5F4B54E943535FB4D357F95291
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\iTubeGo\7z.dll
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
CAE62251925267A56CF14B2C0FA998BA0B49A33612ABC2256604F773A247FA22
(PID) Process:(4604) itubego_v8.0.0_x64.tmpKey:HKEY_CURRENT_USER\SOFTWARE\iTubeGo\iTubeGo
Operation:writeName:language
Value:
0
Executable files
232
Suspicious files
220
Text files
51
Unknown types
3

Dropped files

PID
Process
Filename
Type
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\de.initext
MD5:C82316492E4DCB98651DCDE4DED5C33C
SHA256:EE089A6439F29B60F7EE5AA68B43CAF83CF482066F9879FF23ED902647DCA6F5
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\en.initext
MD5:761DCB59FD2BDC0796911ED7E995D4D4
SHA256:F5E520096EC75AA7017C9B2753C64EB7BF27D6B3CE3AE841C811DB5BFB966516
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\ru.initext
MD5:B17A5C76A6C4FD0BE68126F105A116D2
SHA256:D502131E499167D06D844ACA7D32A38D8BED42AF044650EB0B1D7B6907546345
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\skin\btn\btn_cancel_hover.pngimage
MD5:C55EA4EE9B20218BEEBE666DCFAF0AAD
SHA256:85B3E131D81AC8D51BC546FD02888929035C2AA7DDF22FF63CCFF46285B2134D
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\fr.initext
MD5:1F822119AE1F972D5F5A83EE42AC3EBD
SHA256:9CD60D4F4C6A7A0039BE04029FBCD691D125939E1A573374F58AEEEE15F6F9BE
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\jp.initext
MD5:8A0268FB8064CA25D190E208459E4DDB
SHA256:68C96F9B6B5CAABE2C5E9A88EEEF19D3A09379CA6F77447FD0CFB9CC0A73DE96
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\skin\btn\btn_cancel_normal.pngimage
MD5:B4AB74E009BB0656C50C95691714A779
SHA256:73BD8210AD43110774A573EEAAA752C8801C30C344B2306A368052272DB48539
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\es.initext
MD5:1DAE06D903FDC18A802D623935B1C0CD
SHA256:96D22E1E501B70B963281B4918897BB68FB42368EB32627B84A47FBCB915BA78
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\language\hi.initext
MD5:1753471314BBE3D428D8038B7BC9D66A
SHA256:E46C2BD9D71A73B9FB765B856DB81FD12BC72F95ED738FBFBC13110CC08B8185
6480SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exeC:\Users\admin\AppData\Local\Temp\tmp123_downloader\Cache\e501f\skin\btn\btn_cancel_press.pngimage
MD5:19A43C8071F0D8912B7AE5732D1D6B45
SHA256:588C81B4D8FB041F96181D647567D07742E21611849C8FF8BC010628790BE1E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
54
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6776
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6824
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4100
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3188
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6480
SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe
142.250.185.174:443
www.google-analytics.com
GOOGLE
US
whitelisted
6480
SecuriteInfo.com.Trojan.Inject5.6971.18861.4102.exe
104.21.234.151:443
download.itubego.com
CLOUDFLARENET
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4100
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
download.itubego.com
  • 104.21.234.151
  • 104.21.234.150
unknown
www.google-analytics.com
  • 142.250.185.174
  • 142.250.185.206
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.154
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.134
  • 20.190.160.20
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.115.3.253
whitelisted
th.bing.com
  • 104.126.37.177
  • 104.126.37.186
  • 104.126.37.146
  • 104.126.37.163
  • 104.126.37.145
  • 104.126.37.179
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.170
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
itubegow.exe
C:/Users/admin/AppData/Local/iTubeGo/Log\AppLog.log
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Trojan.Inject5.6971.18861.4102