URL:

http://aresgalaxy.io/aresregular252_updater.exe

Full analysis: https://app.any.run/tasks/2df471f0-341d-4941-b111-ddf578fa50bb
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 05, 2019, 19:21:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
adware
installcore
pup
Indicators:
MD5:

04B3785723E5D7BB2A766DB06A4D09C3

SHA1:

DD222186932306E32F575338ADD50E7891668E44

SHA256:

CB8AAB564DDBC65DE9605DB2BCB382DBD33663AB8071295B75F5D33F97BF30EA

SSDEEP:

3:N1KfQ2R7XAboZAZ:CTMboi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3516)

    • Application was dropped or rewritten from another process

      • aresregular252_updater.exe (PID: 3124)
      • aresregular252_updater.exe (PID: 3820)
      • Ares.exe (PID: 3996)
      • chatClient.exe (PID: 3404)
      • chatClient.exe (PID: 3488)

    • INSTALLCORE was detected

      • aresregular252_updater.exe (PID: 3820)

    • Loads dropped or rewritten executable

      • aresregular252_updater.exe (PID: 3820)

    • Registers / Runs the DLL via REGSVR32.EXE

      • aresregular252_updater.exe (PID: 3820)

    • Connects to CnC server

      • aresregular252_updater.exe (PID: 3820)

    • Changes the autorun value in the registry

      • Ares.exe (PID: 3996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3028)
      • iexplore.exe (PID: 3516)
      • aresregular252_updater.exe (PID: 3820)

    • Reads the machine GUID from the registry

      • aresregular252_updater.exe (PID: 3820)

    • Reads CPU info

      • aresregular252_updater.exe (PID: 3820)

    • Reads Environment values

      • aresregular252_updater.exe (PID: 3820)

    • Reads internet explorer settings

      • aresregular252_updater.exe (PID: 3820)
      • chatClient.exe (PID: 3404)
      • chatClient.exe (PID: 3488)

    • Reads Windows Product ID

      • aresregular252_updater.exe (PID: 3820)

    • Creates files in the program directory

      • aresregular252_updater.exe (PID: 3820)

    • Creates files in the user directory

      • aresregular252_updater.exe (PID: 3820)

    • Creates a software uninstall entry

      • aresregular252_updater.exe (PID: 3820)

    • Modifies the open verb of a shell class

      • aresregular252_updater.exe (PID: 3820)
      • Ares.exe (PID: 3996)

    • Changes IE settings (feature browser emulation)

      • chatClient.exe (PID: 3404)
      • chatClient.exe (PID: 3488)

    • Starts Internet Explorer

      • Ares.exe (PID: 3996)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 3516)
      • iexplore.exe (PID: 3028)
      • iexplore.exe (PID: 3632)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3516)
      • iexplore.exe (PID: 3028)
      • iexplore.exe (PID: 3632)

    • Application launched itself

      • iexplore.exe (PID: 3028)
      • iexplore.exe (PID: 3236)

    • Changes internet zones settings

      • iexplore.exe (PID: 3028)
      • iexplore.exe (PID: 3236)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3632)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3632)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
11
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start iexplore.exe iexplore.exe aresregular252_updater.exe no specs #INSTALLCORE aresregular252_updater.exe regsvr32.exe no specs regsvr32.exe no specs ares.exe chatclient.exe iexplore.exe iexplore.exe chatclient.exe

Process information

PID
CMD
Path
Indicators
Parent process
2372C:\Windows\system32\regsvr32.exe /s "C:\Program Files\Ares\MP3Source.ax"C:\Windows\system32\regsvr32.exe—aresregular252_updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3028"C:\Program Files\Internet Explorer\iexplore.exe" http://aresgalaxy.io/aresregular252_updater.exeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\sechost.dll
3124"C:\Users\admin\Downloads\aresregular252_updater.exe" C:\Users\admin\Downloads\aresregular252_updater.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\aresregular252_updater.exe
c:\systemroot\system32\ntdll.dll
3236"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Ares.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3404- 655652|0.0.0.0|5.66.200.54|46500|1|Ross%20%26%20Mili%27s%20bar%20and%20cafeC:\Program Files\Ares\chatClient.exe
Ares.exe
User:
admin
Company:
Ares Development Group
Integrity Level:
HIGH
Description:
Ares Chat Client
Exit code:
0
Version:
2.3.1.3055
Modules
Images
c:\program files\ares\chatclient.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3488- 655652|85.203.20.5|188.165.1.171|54321|1|UK%20Fight%20RoomC:\Program Files\Ares\chatClient.exe
Ares.exe
User:
admin
Company:
Ares Development Group
Integrity Level:
HIGH
Description:
Ares Chat Client
Exit code:
0
Version:
2.3.1.3055
Modules
Images
c:\program files\ares\chatclient.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3516"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3028 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3632"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3236 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3820"C:\Users\admin\Downloads\aresregular252_updater.exe" C:\Users\admin\Downloads\aresregular252_updater.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\aresregular252_updater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3860C:\Windows\system32\regsvr32.exe /s "C:\Program Files\Ares\AsyncEx.ax"C:\Windows\system32\regsvr32.exe—aresregular252_updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 000
Read events
1 647
Write events
345
Delete events
8

Modification events

(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000077000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{30149DA5-9F5A-11E9-A9B1-5254004A04AF}
Value:
0
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(3028) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307070005000500130016000C00BD02
Executable files
18
Suspicious files
11
Text files
208
Unknown types
15

Dropped files

PID
Process
Filename
Type
3028iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDEECAACBCEBF5054.TMP —
MD5:—
SHA256:—
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{30149DA6-9F5A-11E9-A9B1-5254004A04AF}.datbinary
MD5:—
SHA256:—
3820aresregular252_updater.exeC:\Users\admin\AppData\Local\Temp\00157960.log —
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@aresgalaxy[1].txttext
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OGBPOC57\aresregular252_updater[1].exeexecutable
MD5:—
SHA256:—
3028iexplore.exeC:\Users\admin\Downloads\aresregular252_updater.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
55
TCP/UDP connections
305
DNS requests
15
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3820
aresregular252_updater.exe
HEAD
200
46.166.187.59:80
http://cdneu.downloadstodaybits.com/ofr/Webinebinec/Webinebinec_Links_13Oct15
NL
—
—
malicious
3820
aresregular252_updater.exe
HEAD
200
46.166.187.59:80
http://cdneu.downloadstodaybits.com/ofr/Niniwic/YL/Niniwic_yl_10Apr16
NL
—
—
malicious
3820
aresregular252_updater.exe
GET
200
52.214.73.247:80
http://rp.downloadstodaybits.com/
IE
—
—
malicious
3820
aresregular252_updater.exe
POST
200
52.51.129.59:80
http://os.downloadstodaybits.com/FusionAresGalaxy/
IE
binary
312 Kb
malicious
3820
aresregular252_updater.exe
POST
200
52.214.73.247:80
http://rp.downloadstodaybits.com/
IE
—
—
malicious
3516
iexplore.exe
GET
200
104.27.182.130:80
http://aresgalaxy.io/aresregular252_updater.exe
US
executable
5.74 Mb
malicious
3820
aresregular252_updater.exe
POST
200
52.214.73.247:80
http://rp.downloadstodaybits.com/
IE
—
—
malicious
3820
aresregular252_updater.exe
GET
200
209.95.37.242:80
http://img.downloadstodaybits.com/img/Tavasat/15Feb17/v2_fs/EN.jpg
US
image
23.4 Kb
malicious
3820
aresregular252_updater.exe
GET
200
209.95.37.242:80
http://img.downloadstodaybits.com/img/Jimomoromoj/Jimomoromoj_logo.png
US
image
2.10 Kb
malicious
3820
aresregular252_updater.exe
GET
200
199.115.112.67:80
http://cdnus.downloadstodaybits.com/ofr/Niniwic/YL/Niniwic_yl_10Apr16
US
binary
8.93 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
104.168.144.204:54321
—
Hostwinds LLC.
US
unknown
—
—
104.168.146.91:54321
—
Hostwinds LLC.
US
unknown
3516
iexplore.exe
104.27.182.130:80
aresgalaxy.io
Cloudflare Inc
US
shared
3028
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3820
aresregular252_updater.exe
52.214.73.247:80
rp.downloadstodaybits.com
Amazon.com, Inc.
IE
malicious
3820
aresregular252_updater.exe
52.51.129.59:80
os.downloadstodaybits.com
Amazon.com, Inc.
IE
malicious
3820
aresregular252_updater.exe
209.95.37.242:80
img.downloadstodaybits.com
WestHost, Inc.
US
suspicious
3820
aresregular252_updater.exe
46.166.187.59:80
cdneu.downloadstodaybits.com
NForce Entertainment B.V.
NL
malicious
3820
aresregular252_updater.exe
199.115.112.67:80
cdnus.downloadstodaybits.com
Leaseweb USA, Inc.
US
malicious
3996
Ares.exe
209.95.52.69:80
ares.checkupdater.com
Hosting Services, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
aresgalaxy.io
  • 104.27.182.130
  • 104.27.183.130
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
rp.downloadstodaybits.com
  • 52.214.73.247
  • 54.194.149.175
malicious
os.downloadstodaybits.com
  • 52.51.129.59
  • 52.31.245.195
  • 52.50.98.206
malicious
img.downloadstodaybits.com
  • 209.95.37.242
malicious
cdneu.downloadstodaybits.com
  • 46.166.187.59
malicious
cdnus.downloadstodaybits.com
  • 199.115.112.67
malicious
ares.checkupdater.com
  • 209.95.52.69
suspicious
stream.pcradio.ru
  • 5.9.36.50
unknown
www.1.fm
  • 185.33.21.21
unknown

Threats

PID
Process
Class
Message
3516
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3820
aresregular252_updater.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
3820
aresregular252_updater.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
3820
aresregular252_updater.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3
3820
aresregular252_updater.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4
3996
Ares.exe
Potential Corporate Privacy Violation
ET P2P Ares traffic
16 ETPRO signatures available at the full report
Process
Message
Ares.exe
FastMM has been installed.
Ares.exe
ProcessID:3404
Ares.exe
WindowHandle:131644
chatClient.exe
localdocumentComplete at:about:blank
chatClient.exe
loading remote:http://5.66.200.54:46500/template.htm?user=YWRtaW5fMjRlYTFi
chatClient.exe
remotedocumentComplete:http://5.66.200.54:46500/template.htm?user=YWRtaW5fMjRlYTFi
chatClient.exe
document PASSED test:http://5.66.200.54:46500/template.htm?user=YWRtaW5fMjRlYTFi
Ares.exe
ProcessID:3488
Ares.exe
WindowHandle:131716
chatClient.exe
localdocumentComplete at:about:blank
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://aresgalaxy.io/aresregular252_updater.exe