| File name: | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe |
| Full analysis: | https://app.any.run/tasks/255f7adc-6803-4098-925c-ba58cffe762a |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | April 09, 2026, 22:37:44 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | AC853205F1F271739B05BAFD5CEB8283 |
| SHA1: | 3E853198BA99641994AC2061B627ACA1C0E6C3E6 |
| SHA256: | 9D86EE033AC59E22D33A0C80A6C7CAF3A3D7356680820067FF914E8999E0DC7E |
| SSDEEP: | 98304:Zs0CXrZis8UHWaMARmc3Nm0YUnj2MfomfQoW0WAN6bF9zJf2jYbvr7Q5IK7Gw3dG:/X0/JnlBq |
| .exe | | | Win32 Executable (generic) (3.6) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2026:02:05 12:58:27+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 4648448 |
| InitializedDataSize: | 3684352 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x151ba1 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 8.1.8773.0 |
| ProductVersionNumber: | 8.1.8773.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Unknown (8090) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | Paramount Software UK Ltd |
| FileDescription: | Macrium Reflect Package Download |
| FileVersion: | 8, 1, 8773, 0 |
| InternalName: | Macrium Reflect Package Download |
| LegalCopyright: | (c) Paramount Software. All rights reserved. |
| OriginalFileName: | ReflectDL.exe |
| ProductName: | Macrium Reflect Package Download |
| ProductVersion: | 8, 1, 8773, 0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 784 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2232 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2420 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3748 | "C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" | C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe | explorer.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe Setup Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 4104 | C:\WINDOWS\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoP -NoLogo -NonI -Command - | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4212 | "C:\Users\admin\Desktop\virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe" | C:\Users\admin\Desktop\virussign.com_b8f5f0f6e86714f313f5023bcb3ba223.exe | — | explorer.exe | |||||||||||
User: admin Company: qrytixffwnoaenm Integrity Level: MEDIUM Description: rgxdcxgdsxawsop Exit code: 0 Version: 48.48.48.48 Modules
| |||||||||||||||
| 4340 | "C:\Users\admin\AppData\Local\Temp\bLWuEDetYlks.exe" | C:\Users\admin\AppData\Local\Temp\bLWuEDetYlks.exe | powershell.exe | ||||||||||||
User: admin Company: Nienow - Deckow Integrity Level: MEDIUM Description: synthesizing Bouvet Island (Bouvetoya) Professional Analyzer Version: 5.20.1204 Modules
| |||||||||||||||
| 5200 | "C:\Users\admin\AppData\Local\Temp\is-VBH4MUS76L.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp" /SL5="$B0302,893440,893440,C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" /SPAWNWND=$16028C /FIRSTWND=$90300 | C:\Users\admin\AppData\Local\Temp\is-VBH4MUS76L.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1054.0.0 Modules
| |||||||||||||||
| 5584 | "C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" /SPAWNWND=$16028C /FIRSTWND=$90300 | C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe | virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe Setup Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6084 | "C:\Users\admin\AppData\Local\Temp\is-OCRGS2EEM6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp" /SL5="$90300,893440,893440,C:\Users\admin\Desktop\virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe" | C:\Users\admin\AppData\Local\Temp\is-OCRGS2EEM6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | — | virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1054.0.0 Modules
| |||||||||||||||
| (PID) Process: | (4340) bLWuEDetYlks.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | kxcqmequ |
Value: C:\Users\admin\AppData\Roaming\64n5c-quax8-yye\kxcqmequ.exe | |||
| (PID) Process: | (4340) bLWuEDetYlks.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4340) bLWuEDetYlks.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4340) bLWuEDetYlks.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 6.7.0 | |||
| (PID) Process: | (5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Program Files (x86)\Setup | |||
| (PID) Process: | (5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files (x86)\Setup\ | |||
| (PID) Process: | (5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1 |
| Operation: | write | Name: | Inno Setup: Icon Group |
Value: (Default) | |||
| (PID) Process: | (5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1 |
| Operation: | write | Name: | Inno Setup: User |
Value: admin | |||
| (PID) Process: | (5200) virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bogren Digital Krimh Drums KONTAKT Plugin Crack.exe_is1 |
| Operation: | write | Name: | Inno Setup: Language |
Value: default | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7476 | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe | C:\Users\admin\li.ps1 | text | |
MD5:D9D2A405CDB5B5853E00AA33080C9AE6 | SHA256:BF8578B5C7D90BE1668DF5BC90280617891A5B2F1FA5CC94F04884CDDF3E36F8 | |||
| 5584 | virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe | C:\Users\admin\AppData\Local\Temp\is-VBH4MUS76L.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | executable | |
MD5:4348F65FD98F0DC9FDAFDB2A571B7E71 | SHA256:B8E727DC3FB95DBC6BA9C5F91333A809C34EC9986375D09A687D4582D3F7F737 | |||
| 3748 | virussign.com_b0191acada42715bc1ff03f9019fdeb7.exe | C:\Users\admin\AppData\Local\Temp\is-OCRGS2EEM6.tmp\virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | executable | |
MD5:4348F65FD98F0DC9FDAFDB2A571B7E71 | SHA256:B8E727DC3FB95DBC6BA9C5F91333A809C34EC9986375D09A687D4582D3F7F737 | |||
| 4104 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uxryq4fq.kwg.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4104 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_crbaau31.sdx.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4104 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qc2as2ae.4vx.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4340 | bLWuEDetYlks.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F53EB4E574DE32C870452087D92DBEBB_07B24946D598D36E8B86B9D2750C840B | binary | |
MD5:592E25AD336B71AC6C7D08F824F30E56 | SHA256:820AC32F7C5314237DE298C8C21CEF08C037675FFF8673670DAE57EAE2D806D2 | |||
| 5200 | virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | C:\Users\admin\AppData\Local\Temp\is-A4CAAT5DDH.tmp\is-R19FTQQRR8.tmp | text | |
MD5:7FA3B767C460B54A2BE4D49030B349C7 | SHA256:— | |||
| 5200 | virussign.com_b0191acada42715bc1ff03f9019fdeb7.tmp | C:\Users\admin\AppData\Local\Temp\is-A4CAAT5DDH.tmp\check | text | |
MD5:7FA3B767C460B54A2BE4D49030B349C7 | SHA256:— | |||
| 4104 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3omexxmr.ver.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5532 | SearchApp.exe | GET | 200 | 23.11.41.157:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D | NL | binary | 312 b | whitelisted |
5532 | SearchApp.exe | GET | 200 | 204.79.197.203:80 | http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D | US | binary | 959 b | whitelisted |
5532 | SearchApp.exe | GET | 200 | 184.86.251.9:443 | https://www.bing.com/DSB/search?dsbmr=1&format=dsbjson&client=windowsminiserp&dsbschemaversion=1.1&dsbminiserp=1&q=q&cc=US&setlang=en-us&clientDateTime=4%2F9%2F2026%2C%206%3A37%3A56%20PM | NL | text | 62.0 Kb | whitelisted |
5532 | SearchApp.exe | GET | 200 | 184.86.251.9:443 | https://www.bing.com/manifest/threshold.appcache | NL | text | 1.87 Kb | whitelisted |
5532 | SearchApp.exe | GET | 200 | 184.86.251.9:443 | https://www.bing.com/dsb/scenario?name=TrendingSearchWithCache&cc=us&setlang=en-us | NL | text | 4.38 Kb | whitelisted |
5532 | SearchApp.exe | POST | 204 | 184.86.251.9:443 | https://www.bing.com/threshold/xls.aspx?t=5&dl=1&f=9&wsbc=1 | NL | — | — | whitelisted |
5316 | svchost.exe | GET | 200 | 23.11.41.157:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | NL | binary | 471 b | whitelisted |
5532 | SearchApp.exe | GET | 200 | 184.86.251.9:443 | https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init | NL | html | 97.2 Kb | whitelisted |
5532 | SearchApp.exe | GET | 200 | 184.86.251.9:443 | https://www.bing.com/th?id=ODSWG.ce57ee2d-59bb-4076-8343-51100e8719b0&pid=dsb | NL | image | 23.9 Kb | whitelisted |
5532 | SearchApp.exe | GET | 200 | 184.86.251.9:443 | https://www.bing.com/th?id=ODSWG.691fa42e-b835-4bdf-84fb-f2f94b7f028e&pid=dsb | NL | image | 23.9 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3448 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
5276 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 128.24.231.65:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
5532 | SearchApp.exe | 184.86.251.9:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
5532 | SearchApp.exe | 23.11.41.157:80 | ocsp.digicert.com | AKAMAI-AMS | NL | whitelisted |
5532 | SearchApp.exe | 204.79.197.203:80 | oneocsp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5316 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5316 | svchost.exe | 23.11.41.157:80 | ocsp.digicert.com | AKAMAI-AMS | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
oneocsp.microsoft.com |
| whitelisted |
th.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3448 | svchost.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
2232 | svchost.exe | Exploit Kit Activity Detected | ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain (dcdivas .com) |
7476 | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe | Exploit Kit Activity Detected | ET EXPLOIT_KIT Observed ClickFix Domain (dcdivas .com in TLS SNI) |
7476 | virussign.com_ac853205f1f271739b05bafd5ceb8283.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
2232 | svchost.exe | Exploit Kit Activity Detected | ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain (dcdivas .com) |
4104 | powershell.exe | Exploit Kit Activity Detected | ET EXPLOIT_KIT Observed ClickFix Domain (dcdivas .com in TLS SNI) |
4104 | powershell.exe | A Network Trojan was detected | ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious |
2232 | svchost.exe | Misc activity | ET INFO Observed Smart Chain Domain in DNS Lookup (bsc-dataseed .bnbchain .org) |
4340 | bLWuEDetYlks.exe | Misc activity | ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .bnbchain .org) |
4340 | bLWuEDetYlks.exe | Potential Corporate Privacy Violation | ET INFO Possible ethereum traffic |