We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
22 December 2019, 13:47
Analysis environment:
Windows 7 Pro, build 7601, x86
https://dl.paragon-software.com/esd/797-FRU/Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe
MD5:
D329D6549D4810ACB0247D47F4FA4261
SHA1:
DC53B0216FD2CEE2F8496FFCF6BECB38E07B2407
SHA256:
CAA201C248025BCDE6EFFF5D23AC1A37D67F07E2D680BBDEBD3E4489C206B180
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis https://dl.paragon-software.com/esd/797-FRU/Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Application was dropped or rewritten from another process
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 2508)
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 3100)
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 1416)
Loads dropped or rewritten executable
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 1416)
SUSPICIOUS
Executable content was dropped or overwritten
chrome.exe (PID: 2108)
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 3100)
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 1416)
Creates files in the Windows directory
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 3100)
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 1416)
Removes files from Windows directory
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 3100)
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 1416)
INFO
Application launched itself
chrome.exe (PID: 2108)
Reads the hosts file
chrome.exe (PID: 2108)
chrome.exe (PID: 3976)
Reads settings of System Certificates
chrome.exe (PID: 3976)
Reads Internet Cache Settings
chrome.exe (PID: 2108)
Dropped object may contain Bitcoin addresses
Paragon-797-FRU_WinInstall_x64_17.10.2_000.exe (PID: 1416)
Threats
No threats detected