File name:

virussign.com_ac853205f1f271739b05bafd5ceb8283.exe

Full analysis: https://app.any.run/tasks/255f7adc-6803-4098-925c-ba58cffe762a
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: April 09, 2026, 22:37:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
clickfix
loader
etherhiding
adware
innosetup
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

AC853205F1F271739B05BAFD5CEB8283

SHA1:

3E853198BA99641994AC2061B627ACA1C0E6C3E6

SHA256:

9D86EE033AC59E22D33A0C80A6C7CAF3A3D7356680820067FF914E8999E0DC7E

SSDEEP:

98304:Zs0CXrZis8UHWaMARmc3Nm0YUnj2MfomfQoW0WAN6bF9zJf2jYbvr7Q5IK7Gw3dG:/X0/JnlBq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • CLICKFIX has been detected (SURICATA)

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
      • svchost.exe (PID: 2232)
      • powershell.exe (PID: 4104)
    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Changes the autorun value in the registry

      • bLWuEDetYlks.exe (PID: 4340)
    • ETHERHIDING has been detected (SURICATA)

      • bLWuEDetYlks.exe (PID: 4340)
    • INNOSETUP has been detected (SURICATA)

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
  • SUSPICIOUS

    • Possible stealing from crypto wallets

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Possible stealing from browsers

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Possible stealing of email data

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Searches for installed software

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Possible stealing of messenger data

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Possible stealing from password managers

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • The process hide an interactive prompt from the user

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Executes script without checking the security policy

      • powershell.exe (PID: 4104)
    • Starts POWERSHELL.EXE for commands execution

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • The process hides Powershell's copyright startup banner

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Contacting a server suspected of hosting an Exploit Kit

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
      • svchost.exe (PID: 2232)
      • powershell.exe (PID: 4104)
    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Executable content was dropped or overwritten

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 3748)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 5584)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
      • powershell.exe (PID: 4104)
      • bLWuEDetYlks.exe (PID: 4340)
    • The process bypasses the loading of PowerShell profile settings

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
    • Reads the Windows owner or organization settings

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
    • Application launched itself

      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 4212)
    • Access to an unwanted program domain was detected

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
    • Potential Corporate Privacy Violation

      • bLWuEDetYlks.exe (PID: 4340)
  • INFO

    • Reads the machine GUID from the registry

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
      • bLWuEDetYlks.exe (PID: 4340)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 4212)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 8048)
    • Checks supported languages

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 3748)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 6084)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 5584)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
      • bLWuEDetYlks.exe (PID: 4340)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 4212)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 8048)
    • Reads the computer name

      • virussign.com_ac853205f1f271739b05bafd5ceb8283.exe (PID: 7476)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 5584)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 6084)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 4212)
      • bLWuEDetYlks.exe (PID: 4340)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 8048)
    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 4104)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 6084)
      • bLWuEDetYlks.exe (PID: 4340)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Manual execution by a user

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 3748)
      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 4212)
    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Create files in a temporary directory

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 3748)
      • powershell.exe (PID: 4104)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe (PID: 5584)
      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
    • The sample compiled with english language support

      • powershell.exe (PID: 4104)
      • bLWuEDetYlks.exe (PID: 4340)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4104)
    • Creates files or folders in the user directory

      • bLWuEDetYlks.exe (PID: 4340)
    • Process checks computer location settings

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 6084)
    • Launching a file from a Registry key

      • bLWuEDetYlks.exe (PID: 4340)
    • Creates a software uninstall entry

      • virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp (PID: 5200)
    • Disables trace logs

      • virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe (PID: 8048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:02:05 12:58:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 4648448
InitializedDataSize: 3684352
UninitializedDataSize: -
EntryPoint: 0x151ba1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.1.8773.0
ProductVersionNumber: 8.1.8773.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (8090)
CharacterSet: Windows, Latin1
CompanyName: Paramount Software UK Ltd
FileDescription: Macrium Reflect Package Download
FileVersion: 8, 1, 8773, 0
InternalName: Macrium Reflect Package Download
LegalCopyright: (c) Paramount Software. All rights reserved.
OriginalFileName: ReflectDL.exe
ProductName: Macrium Reflect Package Download
ProductVersion: 8, 1, 8773, 0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
15
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #CLICKFIX virussign.com_ac853205f1f271739b05bafd5ceb8283.exe chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs #CLICKFIX svchost.exe #CLICKFIX powershell.exe conhost.exe no specs virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp no specs virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe #INNOSETUP virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp #ETHERHIDING blwuedetylks.exe virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe no specs virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe

Process information

PID
CMD
Path
Indicators
Parent process
784"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exevirussign.com_ac853205f1f271739b05bafd5ceb8283.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2420"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exevirussign.com_ac853205f1f271739b05bafd5ceb8283.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3748"C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe Setup
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
4104C:\WINDOWS\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoP -NoLogo -NonI -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
virussign.com_ac853205f1f271739b05bafd5ceb8283.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4212"C:\Users\admin\Desktop\virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe" C:\Users\admin\Desktop\virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exeexplorer.exe
User:
admin
Company:
qrytixffwnoaenm
Integrity Level:
MEDIUM
Description:
rgxdcxgdsxawsop
Exit code:
0
Version:
48.48.48.48
Modules
Images
c:\users\admin\desktop\virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4340"C:\Users\admin\AppData\Local\Temp\bLWuEDetYlks.exe" C:\Users\admin\AppData\Local\Temp\bLWuEDetYlks.exe
powershell.exe
User:
admin
Company:
Nienow - Deckow
Integrity Level:
MEDIUM
Description:
synthesizing Bouvet Island (Bouvetoya) Professional Analyzer
Version:
5.20.1204
Modules
Images
c:\users\admin\appdata\local\temp\blwuedetylks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5200"C:\Users\admin\AppData\Local\Temp\is-VBH4MUS76L.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp" /SL5="$B0302,893440,893440,C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" /SPAWNWND=$16028C /FIRSTWND=$90300 C:\Users\admin\AppData\Local\Temp\is-VBH4MUS76L.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp
virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-vbh4mus76l.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5584"C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" /SPAWNWND=$16028C /FIRSTWND=$90300 C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe
virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe Setup
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
6084"C:\Users\admin\AppData\Local\Temp\is-OCRGS2EEM6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp" /SL5="$90300,893440,893440,C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" C:\Users\admin\AppData\Local\Temp\is-OCRGS2EEM6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpvirussign.com_b0191acada42715bc1ff03f9019fdeb7.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ocrgs2eem6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
10 408
Read events
10 372
Write events
36
Delete events
0

Modification events

(PID) Process:(4340) bLWuEDetYlks.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:kxcqmequ
Value:
C:\Users\admin\AppData\Roaming\64n5c-quax8-yye\kxcqmequ.exe
(PID) Process:(4340) bLWuEDetYlks.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4340) bLWuEDetYlks.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4340) bLWuEDetYlks.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.7.0
(PID) Process:(5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\Setup
(PID) Process:(5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Setup\
(PID) Process:(5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1
Operation:writeName:Inno Setup: Language
Value:
default
Executable files
7
Suspicious files
10
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7476virussign.com_ac853205f1f271739b05bafd5ceb8283.exeC:\Users\admin\li.ps1text
MD5:D9D2A405CDB5B5853E00AA33080C9AE6
SHA256:BF8578B5C7D90BE1668DF5BC90280617891A5B2F1FA5CC94F04884CDDF3E36F8
5584virussign.com_b0191acada42715bc1ff03f9019fdeb7.exeC:\Users\admin\AppData\Local\Temp\is-VBH4MUS76L.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpexecutable
MD5:4348F65FD98F0DC9FDAFDB2A571B7E71
SHA256:B8E727DC3FB95DBC6BA9C5F91333A809C34EC9986375D09A687D4582D3F7F737
3748virussign.com_b0191acada42715bc1ff03f9019fdeb7.exeC:\Users\admin\AppData\Local\Temp\is-OCRGS2EEM6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpexecutable
MD5:4348F65FD98F0DC9FDAFDB2A571B7E71
SHA256:B8E727DC3FB95DBC6BA9C5F91333A809C34EC9986375D09A687D4582D3F7F737
4104powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uxryq4fq.kwg.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4104powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_crbaau31.sdx.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4104powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qc2as2ae.4vx.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4340bLWuEDetYlks.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F53EB4E574DE32C870452087D92DBEBB_07B24946D598D36E8B86B9D2750C840Bbinary
MD5:592E25AD336B71AC6C7D08F824F30E56
SHA256:820AC32F7C5314237DE298C8C21CEF08C037675FFF8673670DAE57EAE2D806D2
5200virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpC:\Users\admin\AppData\Local\Temp\is-A4CAAT5DDH.tmp\is-R19FTQQRR8.tmptext
MD5:7FA3B767C460B54A2BE4D49030B349C7
SHA256:
5200virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmpC:\Users\admin\AppData\Local\Temp\is-A4CAAT5DDH.tmp\checktext
MD5:7FA3B767C460B54A2BE4D49030B349C7
SHA256:
4104powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3omexxmr.ver.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
599
TCP/UDP connections
81
DNS requests
31
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5532
SearchApp.exe
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
NL
binary
312 b
whitelisted
5532
SearchApp.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
959 b
whitelisted
5532
SearchApp.exe
GET
200
184.86.251.9:443
https://www.bing.com/DSB/search?dsbmr=1&format=dsbjson&client=windowsminiserp&dsbschemaversion=1.1&dsbminiserp=1&q=q&cc=US&setlang=en-us&clientDateTime=4%2F9%2F2026%2C%206%3A37%3A56%20PM
NL
text
62.0 Kb
whitelisted
5532
SearchApp.exe
GET
200
184.86.251.9:443
https://www.bing.com/manifest/threshold.appcache
NL
text
1.87 Kb
whitelisted
5532
SearchApp.exe
GET
200
184.86.251.9:443
https://www.bing.com/dsb/scenario?name=TrendingSearchWithCache&cc=us&setlang=en-us
NL
text
4.38 Kb
whitelisted
5532
SearchApp.exe
POST
204
184.86.251.9:443
https://www.bing.com/threshold/xls.aspx?t=5&dl=1&f=9&wsbc=1
NL
whitelisted
5316
svchost.exe
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
NL
binary
471 b
whitelisted
5532
SearchApp.exe
GET
200
184.86.251.9:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
NL
html
97.2 Kb
whitelisted
5532
SearchApp.exe
GET
200
184.86.251.9:443
https://www.bing.com/th?id=ODSWG.ce57ee2d-59bb-4076-8343-51100e8719b0&pid=dsb
NL
image
23.9 Kb
whitelisted
5532
SearchApp.exe
GET
200
184.86.251.9:443
https://www.bing.com/th?id=ODSWG.691fa42e-b835-4bdf-84fb-f2f94b7f028e&pid=dsb
NL
image
23.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3448
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
Not routed
whitelisted
5276
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
128.24.231.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
Not routed
whitelisted
5532
SearchApp.exe
184.86.251.9:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
5532
SearchApp.exe
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
5532
SearchApp.exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 51.104.136.2
whitelisted
activation-v2.sls.microsoft.com
  • 128.24.231.65
whitelisted
google.com
  • 142.250.154.113
  • 142.250.154.138
  • 142.250.154.101
  • 142.250.154.100
  • 142.250.154.139
  • 142.250.154.102
whitelisted
www.bing.com
  • 184.86.251.9
  • 184.86.251.7
  • 184.86.251.21
  • 184.86.251.27
  • 184.86.251.22
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
th.bing.com
  • 184.86.251.9
  • 184.86.251.19
  • 184.86.251.13
  • 184.86.251.21
  • 184.86.251.20
  • 184.86.251.27
  • 184.86.251.7
  • 184.86.251.22
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.65
  • 20.190.160.67
  • 20.190.160.14
  • 20.190.160.2
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.68
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
crl.microsoft.com
  • 23.55.110.211
  • 23.55.110.193
whitelisted

Threats

PID
Process
Class
Message
3448
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2232
svchost.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain (dcdivas .com)
7476
virussign.com_ac853205f1f271739b05bafd5ceb8283.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT Observed ClickFix Domain (dcdivas .com in TLS SNI)
7476
virussign.com_ac853205f1f271739b05bafd5ceb8283.exe
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
2232
svchost.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain (dcdivas .com)
4104
powershell.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT Observed ClickFix Domain (dcdivas .com in TLS SNI)
4104
powershell.exe
A Network Trojan was detected
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
2232
svchost.exe
Misc activity
ET INFO Observed Smart Chain Domain in DNS Lookup (bsc-dataseed .bnbchain .org)
4340
bLWuEDetYlks.exe
Misc activity
ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .bnbchain .org)
4340
bLWuEDetYlks.exe
Potential Corporate Privacy Violation
ET INFO Possible ethereum traffic
No debug info