File name:

MG002.exe

Full analysis: https://app.any.run/tasks/db35cfb1-de63-449a-ba5c-bc2079102305
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 22, 2021, 07:32:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
pua
lavasoft
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

011460F79AF9BB2223C16952BC769B47

SHA1:

EC5ED38821E086B3A8752899727DD3115737D82A

SHA256:

C9B4940436276FA9713EC3084A2EF5F2200F3DE3084B6548283794EBC10DD7C5

SSDEEP:

49152:KG5UfgbjCbePAr21CRlrxuRpY585Prcv93+wOwKdpplMrCAi6BQ7OA14:KG5QgbysM4wrxuRZcvgwOrvMrCLsk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GenericSetup.exe (PID: 3976)
      • installer.exe (PID: 2488)

    • Loads dropped or rewritten executable

      • GenericSetup.exe (PID: 3976)
      • installer.exe (PID: 2488)

    • Drops executable file immediately after starts

      • MG002.exe (PID: 3896)

    • LAVASOFT was detected

      • installer.exe (PID: 2488)

    • Changes settings of System certificates

      • GenericSetup.exe (PID: 3976)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • MG002.exe (PID: 3896)

    • Executable content was dropped or overwritten

      • MG002.exe (PID: 3896)

    • Drops a file with a compile date too recent

      • MG002.exe (PID: 3896)

    • Drops a file that was compiled in debug mode

      • MG002.exe (PID: 3896)

    • Reads Windows owner or organization settings

      • GenericSetup.exe (PID: 3976)

    • Reads Environment values

      • GenericSetup.exe (PID: 3976)

    • Reads the Windows organization settings

      • GenericSetup.exe (PID: 3976)

    • Adds / modifies Windows certificates

      • GenericSetup.exe (PID: 3976)

    • Searches for installed software

      • GenericSetup.exe (PID: 3976)

  • INFO

    • Reads settings of System Certificates

      • GenericSetup.exe (PID: 3976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:04:18 20:54:06+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 104448
InitializedDataSize: 39424
UninitializedDataSize: -
EntryPoint: 0x148d4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.5.8.0
ProductVersionNumber: 2.5.8.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 2.5.8.0
ProductVersion: 2.5.8.0
CompanyName: MG002
FileDescription: Imgburn
InternalName: MG002.exe
LegalCopyright: Copyright © Adaware 2020
OriginalFileName: MG002.exe
ProductName: Imgburn
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start mg002.exe #LAVASOFT installer.exe genericsetup.exe mg002.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\AppData\Local\Temp\MG002.exe" C:\Users\admin\AppData\Local\Temp\MG002.exe—explorer.exe
User:
admin
Company:
MG002
Integrity Level:
MEDIUM
Description:
Imgburn
Exit code:
3221226540
Version:
2.5.8.0
Modules
Images
c:\users\admin\appdata\local\temp\mg002.exe
c:\systemroot\system32\ntdll.dll
2488.\installer.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\installer.exe
MG002.exe
User:
admin
Company:
adaware
Integrity Level:
HIGH
Description:
Imgburn
Exit code:
0
Version:
6.0.1.4036
Modules
Images
c:\users\admin\appdata\local\temp\7zs83f7bfa4\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
3896"C:\Users\admin\AppData\Local\Temp\MG002.exe" C:\Users\admin\AppData\Local\Temp\MG002.exe
explorer.exe
User:
admin
Company:
MG002
Integrity Level:
HIGH
Description:
Imgburn
Exit code:
0
Version:
2.5.8.0
Modules
Images
c:\users\admin\appdata\local\temp\mg002.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3976"C:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\GenericSetup.exe" C:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\GenericSetup.exe hik=0cc06273-31f1-4418-9741-bb1fae0bf137 hmk=0a212413-37ac-8b3b-b257-988ffe3e958d hut=Admin hpp="QzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE1HMDAyLmV4ZQ==" hts=1616398375861C:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\GenericSetup.exe
installer.exe
User:
admin
Integrity Level:
HIGH
Description:
Imgburn
Exit code:
0
Version:
1.0.2.4036
Modules
Images
c:\users\admin\appdata\local\temp\7zs83f7bfa4\genericsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
5 190
Read events
5 171
Write events
19
Delete events
0

Modification events

(PID) Process:(2488) installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2488) installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3976) GenericSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3976) GenericSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3976) GenericSetup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3976) GenericSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
Operation:writeName:Blob
Value:
040000000100000010000000ACB694A59C17E0D791529BB19706A6E40F0000000100000014000000CE0E658AA3E847E467A147B3049191093D055E6F030000000100000014000000D4DE20D05E66FC53FE1A50882C78DB2852CAE4741D0000000100000010000000918AD43A9475F78BB5243DE886D8103C140000000100000014000000E59D5930824758CCACFA085436867B3AB5044DF062000000010000002000000016AF57A9F676B0AB126095AA5EBADEF22AB31119D644AC95CD4B93DBF3F26AEB0B0000000100000030000000440069006700690043006500720074002000420061006C00740069006D006F0072006500200052006F006F007400000009000000010000003E000000303C06082B0601050507030106082B0601050507030406082B0601050507030206082B0601050507030306082B0601050507030906082B0601050507030853000000010000006200000030603020060A2B06010401B13E01640130123010060A2B0601040182373C0101030200C0301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0301B060567810C010130123010060A2B0601040182373C0101030200C019000000010000001000000068CB42B035EA773E52EF50ECF50EC52920000000010000007B030000308203773082025FA0030201020204020000B9300D06092A864886F70D0101050500305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F74301E170D3030303531323138343630305A170D3235303531323233353930305A305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F7430820122300D06092A864886F70D01010105000382010F003082010A0282010100A304BB22AB983D57E826729AB579D429E2E1E89580B1B0E35B8E2B299A64DFA15DEDB009056DDB282ECE62A262FEB488DA12EB38EB219DC0412B01527B8877D31C8FC7BAB988B56A09E773E81140A7D1CCCA628D2DE58F0BA650D2A850C328EAF5AB25878A9A961CA967B83F0CD5F7F952132FC21BD57070F08FC012CA06CB9AE1D9CA337A77D6F8ECB9F16844424813D2C0C2A4AE5E60FEB6A605FCB4DD075902D459189863F5A563E0900C7D5DB2067AF385EAEBD403AE5E843E5FFF15ED69BCF939367275CF77524DF3C9902CB93DE5C923533F1F2498215C079929BDC63AECE76E863A6B97746333BD681831F0788D76BFFC9E8E5D2A86A74D90DC271A390203010001A3453043301D0603551D0E04160414E59D5930824758CCACFA085436867B3AB5044DF030120603551D130101FF040830060101FF020103300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100850C5D8EE46F51684205A0DDBB4F27258403BDF764FD2DD730E3A41017EBDA2929B6793F76F6191323B8100AF958A4D46170BD04616A128A17D50ABDC5BC307CD6E90C258D86404FECCCA37E38C637114FEDDD68318E4CD2B30174EEBE755E07481A7F70FF165C84C07985B805FD7FBE6511A30FC002B4F852373904D5A9317A18BFA02AF41299F7A34582E33C5EF59D9EB5C89E7C2EC8A49E4E08144B6DFD706D6B1A63BD64E61FB7CEF0F29F2EBB1BB7F250887392C2E2E3168D9A3202AB8E18DDE91011EE7E35AB90AF3E30947AD0333DA7650FF5FC8E9E62CF47442C015DBB1DB532D247D2382ED0FE81DC326A1EB5EE3CD5FCE7811D19C32442EA6339A9
Executable files
28
Suspicious files
0
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\BundleConfig.jsontext
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\Resources\OfferPage.htmlhtml
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\Resources\DownloadFolderPage.htmlhtml
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\Resources\images\loader.gifimage
MD5:2B26F73D382AB69F3914A7D9FDA97B0F
SHA256:A6A0B05B1D5C52303DD3E9E2F9CDA1E688A490FBE84EA0D6E22A051AB6EFD643
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\de\DevLib.resources.dllexecutable
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\de\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\DevLib.dllexecutable
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\DynActsBLL.dllexecutable
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\DevLib.Services.dllexecutable
MD5:—
SHA256:—
3896MG002.exeC:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\app.icoimage
MD5:88927B3CCD77648230E4BF6170A1CABC
SHA256:CCA78F315DDF35D5C2FF0A62CE0FB532F77D010B0FF89DA861EEC2DB14F6F240
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
5
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2488
installer.exe
POST
200
104.18.87.101:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
US
text
29 b
whitelisted
2488
installer.exe
POST
200
104.18.88.101:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
US
text
29 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2488
installer.exe
104.18.87.101:80
flow.lavasoft.com
Cloudflare Inc
US
shared
3976
GenericSetup.exe
144.217.253.21:80
download.imgburn.com
OVH SAS
CA
suspicious
3976
GenericSetup.exe
104.18.88.101:443
flow.lavasoft.com
Cloudflare Inc
US
shared
2488
installer.exe
104.18.88.101:80
flow.lavasoft.com
Cloudflare Inc
US
shared
3976
GenericSetup.exe
104.16.235.79:443
sos.adaware.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
flow.lavasoft.com
  • 104.18.87.101
  • 104.18.88.101
whitelisted
download.imgburn.com
  • 144.217.253.21
unknown
www.google.com
  • 142.250.185.132
malicious
sos.adaware.com
  • 104.16.235.79
  • 104.16.236.79
whitelisted

Threats

PID
Process
Class
Message
2488
installer.exe
A Network Trojan was detected
ET MALWARE Lavasoft PUA/Adware Client Install
3976
GenericSetup.exe
A Network Trojan was detected
ET INFO Suspicious Windows NT version 9 User-Agent
Process
Message
installer.exe
[debug][2021-03-22 07:32:52.705250][installer][wWinMain][223]: bundle config file path=C:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\BundleConfig.json
installer.exe
[debug][2021-03-22 07:32:52.705250][installer][CreateBundleConfig][96]: DisableStubEvents=0
installer.exe
[debug][2021-03-22 07:32:52.720875][installer][wWinMain][230]: install id=0cc06273-31f1-4418-9741-bb1fae0bf137
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][wWinMain][234]: machine Id id=0a212413-37ac-8b3b-b257-988ffe3e958d
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][wWinMain][386]: generic setup path=C:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\GenericSetup.exe
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][EventService::SendEvent][29]: send event. event name=StubStart. disable stub events=0
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][EventService::SendEvent][77]: StubStart data = {"Data":{"EventCategory":"Success","BundleId":"MG002","DeltaMs":0,"MachineId":"0a212413-37ac-8b3b-b257-988ffe3e958d","InstallId":"0cc06273-31f1-4418-9741-bb1fae0bf137","PartnerVersion":"1.0.2.4036","BundleVersion":"6.0.2.0","OsVersion":"Microsoft Windows 7 Professional Service Pack 1 (build 7601), 32-bit","DotNetFramework":"3.5, 4.0 Client, 4.0 Full, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7.0, 4.7.1, 4.7.2"}}
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][ProcessService::GetProcessName][46]: Module filename is: C:\Users\admin\AppData\Local\Temp\MG002.exe
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][EventService::SendEvent][86]: url=http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
installer.exe
[debug][2021-03-22 07:32:55.861500][installer][wWinMain][393]: cmd=C:\Users\admin\AppData\Local\Temp\7zS83F7BFA4\GenericSetup.exe hik=0cc06273-31f1-4418-9741-bb1fae0bf137 hmk=0a212413-37ac-8b3b-b257-988ffe3e958d hut=Admin hpp="QzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE1HMDAyLmV4ZQ==" hts=1616398375861
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MG002.exe