File name:

smfree_dm.exe

Full analysis: https://app.any.run/tasks/63fde33c-fb48-47a1-bb26-cea5f620e517
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 04, 2024, 21:45:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BCF6BCBE863D11DB7036B9DC2CBE17FF

SHA1:

5BCE00D2BCF1BC35D57293FA9D9A7C27A7A03AD2

SHA256:

97CB95762B5865EDABCE1E5CFA21D75B86D0E90C69D3239A248EACDAEA99E35E

SSDEEP:

98304:oD8Txkkxu60wIO3Fv2W+oekubm6RBUZctukdazmSsMqwDc2bISfzX:3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • smfree_dm.exe (PID: 3976)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Creates a writable file in the system directory

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iolo.exe (PID: 2712)

    • Steals credentials from Web Browsers

      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Actions looks like stealing of personal data

      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • smfree_dm.exe (PID: 3976)
      • incinerator.exe (PID: 188)
      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)

    • Reads the Internet Settings

      • smfree_dm.exe (PID: 3976)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Searches for installed software

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Reads security settings of Internet Explorer

      • smfree_dm.exe (PID: 3976)
      • iolo.exe (PID: 2712)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 3860)

    • Reads settings of System Certificates

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Executable content was dropped or overwritten

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Creates or modifies Windows services

      • nfregdrv.exe (PID: 860)

    • Process drops SQLite DLL files

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Process drops legitimate windows executable

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Drops a system driver (possible attempt to evade defenses)

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Creates files in the driver directory

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Creates a software uninstall entry

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)

    • Reads Microsoft Outlook installation path

      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Changes Internet Explorer settings (feature browser emulation)

      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Reads Internet Explorer settings

      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3040)

  • INFO

    • Create files in a temporary directory

      • smfree_dm.exe (PID: 3976)

    • Creates files in the program directory

      • smfree_dm.exe (PID: 3976)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Checks supported languages

      • smfree_dm.exe (PID: 3976)
      • wmpnscfg.exe (PID: 820)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • nfregdrv.exe (PID: 860)
      • incinerator.exe (PID: 188)
      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 3388)
      • ioloTrayApp.exe (PID: 2672)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)
      • ioloTrayApp.exe (PID: 3728)

    • Reads the computer name

      • smfree_dm.exe (PID: 3976)
      • wmpnscfg.exe (PID: 820)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • nfregdrv.exe (PID: 860)
      • incinerator.exe (PID: 188)
      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)
      • ioloTrayApp.exe (PID: 3728)

    • Reads the machine GUID from the registry

      • smfree_dm.exe (PID: 3976)
      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)
      • ioloTrayApp.exe (PID: 3728)

    • Checks proxy server information

      • smfree_dm.exe (PID: 3976)
      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 820)
      • iolo.exe (PID: 3540)
      • iolo.exe (PID: 3860)

    • Creates files or folders in the user directory

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • regsvr32.exe (PID: 3040)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)
      • ioloTrayApp.exe (PID: 3728)

    • Reads the software policy settings

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • iolo.exe (PID: 2712)
      • iolo.exe (PID: 3860)

    • Reads Environment values

      • SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe (PID: 1580)
      • incinerator.exe (PID: 188)
      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 3388)
      • ioloTrayApp.exe (PID: 692)
      • ioloTrayApp.exe (PID: 3728)

    • Reads product name

      • iolo.exe (PID: 2712)
      • incinerator.exe (PID: 188)
      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)

    • Reads the time zone

      • iolo.exe (PID: 2712)
      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • iolo.exe (PID: 3860)
      • ioloTrayApp.exe (PID: 692)

    • Reads Microsoft Office registry keys

      • ioloTrayApp.exe (PID: 2672)
      • ioloTrayApp.exe (PID: 3388)
      • ioloTrayApp.exe (PID: 692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:01:31 19:12:04+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 3523584
InitializedDataSize: 1331200
UninitializedDataSize: -
EntryPoint: 0x35d560
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.2.5
ProductVersionNumber: 3.0.2.5
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: iolo technologies, LLC
FileDescription: 11A12794-499E-4FA0-A281-A9A9AA8B2685
FileVersion: 3.0.2.5
InternalName: -
LegalCopyright: Copyright 1998-2017 iolo technologies, LLC. All rights reserved.
LegalTrademarks: -
OriginalFileName: -
ProductName: iolo Download Manager
ProductVersion: 3.0.2.5
Comments: Copyright 1998-2017 iolo technologies, LLC. All rights reserved.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
15
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start smfree_dm.exe wmpnscfg.exe no specs systemmechanic_3abd7ae4-8887-4599-86df-f9077508a5a4.exe no specs systemmechanic_3abd7ae4-8887-4599-86df-f9077508a5a4.exe nfregdrv.exe no specs incinerator.exe no specs netsh.exe no specs iolo.exe iolotrayapp.exe regsvr32.exe no specs iolotrayapp.exe iolo.exe no specs iolo.exe iolotrayapp.exe iolotrayapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\iolo technologies\System Mechanic\incinerator.exe" /regserverC:\Program Files\iolo technologies\System Mechanic\incinerator.exe—SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
Incinerator
Exit code:
0
Version:
23.7.0.1
Modules
Images
c:\program files\iolo technologies\system mechanic\incinerator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winspool.drv
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
692"C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe" C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe
iolo.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
ioloTrayApp
Exit code:
0
Version:
24.3.1.11
Modules
Images
c:\program files\iolo technologies\system mechanic\iolotrayapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
820"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
860"C:\Program Files\iolo technologies\System Mechanic\WPF_Driver\release\win32\nfregdrv.exe" pgfilterC:\Program Files\iolo technologies\System Mechanic\WPF_Driver\release\win32\nfregdrv.exe—SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\iolo technologies\system mechanic\wpf_driver\release\win32\nfregdrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iolo technologies\system mechanic\wpf_driver\release\win32\nfapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
1580"C:\Users\admin\AppData\Local\Temp\iolo\dm\SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=3ABD7AE4-8887-4599-86DF-F9077508A5A4C:\Users\admin\AppData\Local\Temp\iolo\dm\SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
smfree_dm.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
System Mechanic
Exit code:
0
Version:
24.3.1.11
Modules
Images
c:\users\admin\appdata\local\temp\iolo\dm\systemmechanic_3abd7ae4-8887-4599-86df-f9077508a5a4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2032"C:\Users\admin\AppData\Local\Temp\iolo\dm\SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=3ABD7AE4-8887-4599-86DF-F9077508A5A4C:\Users\admin\AppData\Local\Temp\iolo\dm\SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe—smfree_dm.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
MEDIUM
Description:
System Mechanic
Exit code:
3221226540
Version:
24.3.1.11
Modules
Images
c:\users\admin\appdata\local\temp\iolo\dm\systemmechanic_3abd7ae4-8887-4599-86df-f9077508a5a4.exe
c:\windows\system32\ntdll.dll
2516"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name=ioloTrayApp dir=in action=allow program="C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe" enable=yesC:\Windows\System32\netsh.exe—SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2672"C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe" C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe
iolo.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
ioloTrayApp
Exit code:
0
Version:
24.3.1.11
Modules
Images
c:\program files\iolo technologies\system mechanic\iolotrayapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2712"C:\Program Files\iolo technologies\System Mechanic\iolo.exe"C:\Program Files\iolo technologies\System Mechanic\iolo.exe
SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
System Mechanic
Exit code:
3221225547
Version:
24.3.1.11
Modules
Images
c:\program files\iolo technologies\system mechanic\iolo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3040"regsvr32" "C:\Program Files\iolo technologies\System Mechanic\Incinerator.dll" /sC:\Windows\System32\regsvr32.exe—iolo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
40 311
Read events
39 954
Write events
348
Delete events
9

Modification events

(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3976) smfree_dm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
104
Suspicious files
11
Text files
28
Unknown types
8

Dropped files

PID
Process
Filename
Type
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Users\admin\AppData\Local\Microsoft\ApplicationInsights\0635b2bde4838a3246a4b65cb7e6a20953f7f49bd794a44e782a9fb1a38da0a9\5e2gr5xv.uwkbinary
MD5:93B885ADFE0DA089CDF634904FD59F71
SHA256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\Incinerator.dllexecutable
MD5:1DE7CCDA2629F06F4B079CFBA48DA4E2
SHA256:F0F5EECE9A4E0FE005053F472C113E206B3C1E87652DB0BCF473116FE6B90017
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\ProgramData\iolo technologies\logs\bootstrap.logtext
MD5:9A23C823C480650A8B4BED8BA46944B1
SHA256:B312081784C3D9521D1126CE8D68679AC096F38DF201ACC9D19623F24DB4A2E9
3976smfree_dm.exeC:\ProgramData\iolo\logs\WSComm.logtext
MD5:60B4104AF9AD6101DF20906E5A57B624
SHA256:113F904B2D0A1B30082A6B8E87608EF7AA1B62F1D27F4CA770ECAB0F3A6819F2
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\defrag.dllexecutable
MD5:2B032A651FE114CAB3E25EA903CE297C
SHA256:F68DD92075E28BCCCFD7408508AE56A6CBC48F71F5E98E3DE5EADEADF76C6CBC
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\Microsoft.mshtml.dllexecutable
MD5:0A14A91128906EAE7105A01B1377BEC8
SHA256:0F2B2F940C88774F60DFCE3FE813445A294F24567AFCAD0C1EB7B43CC2B1B613
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\log4net.dllexecutable
MD5:861802D15EEF6913EB1AA69E470C1F21
SHA256:3E14052FBCFECABD49BF2B128270BC116F53C1C09A48B32D7BAE8AF540C906F6
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\Incinerator.exeexecutable
MD5:24BAFFCF389CCEAAA4C4A718FC8CF203
SHA256:F78C6118CA37172896F8C10C81CC1F177E5913042BC9E965333F2BF6C636E9F7
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\gpp.exeexecutable
MD5:F210A6D418292A4D4D526A81CB59DE18
SHA256:0E2061E8FB9D201229DC50463468E3AD56691C240F7FE11770CFC178DEF407F3
1580SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exeC:\Program Files\iolo technologies\System Mechanic\WebView2Loader.dllexecutable
MD5:AB2836155940EF3638E124C45A9DF5DA
SHA256:E881EB1A703D48929D38A1BDE8B35BFC43B6B470E09DACF9E03A94FC7D4AFB6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
18
DNS requests
11
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3976
smfree_dm.exe
POST
200
20.157.87.45:80
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
unknown
—
—
unknown
884
svchost.exe
HEAD
200
169.150.247.40:80
http://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic_Free.exe
unknown
—
—
unknown
884
svchost.exe
GET
200
169.150.247.40:80
http://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic_Free.exe
unknown
—
—
unknown
3976
smfree_dm.exe
POST
200
20.157.87.45:80
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
unknown
—
—
unknown
2712
iolo.exe
HEAD
200
138.199.36.8:80
http://download.iolo.net/sm/supertuds/default/tud.dat
unknown
—
—
unknown
2712
iolo.exe
HEAD
200
138.199.36.8:80
http://download.iolo.net/sm/profiles/default/profiles.dat
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3976
smfree_dm.exe
20.157.87.45:80
svc.iolo.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4060
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
884
svchost.exe
169.150.247.40:80
download.iolo.net
—
GB
unknown
1580
SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
20.9.155.150:443
westus2-2.in.applicationinsights.azure.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1580
SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
20.190.22.230:443
api.iolo.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2712
iolo.exe
138.199.36.8:80
download.iolo.net
Datacamp Limited
DE
unknown

DNS requests

Domain
IP
Reputation
svc.iolo.com
  • 20.157.87.45
unknown
download.iolo.net
  • 169.150.247.40
  • 138.199.36.8
whitelisted
westus2-2.in.applicationinsights.azure.com
  • 20.9.155.150
unknown
api.iolo.net
  • 20.190.22.230
unknown

Threats

PID
Process
Class
Message
884
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
Process
Message
smfree_dm.exe
-> No proxy. Direct connection
smfree_dm.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
smfree_dm.exe
IsValidCommunication : Result := True.
smfree_dm.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
smfree_dm.exe
-> No proxy. Direct connection
smfree_dm.exe
IsValidCommunication : Result := True.
SystemMechanic_3ABD7AE4-8887-4599-86DF-F9077508A5A4.exe
Telemetry track event installation
iolo.exe
iolo.exe InitializeToolkit enter False
iolo.exe
Log enabled 0
ioloTrayApp.exe
Log enabled 0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
smfree_dm.exe