File name:

Advanced.exe

Full analysis: https://app.any.run/tasks/3f3fbfc8-0196-4206-ac29-ee7881ca9074
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 25, 2019, 11:13:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
icloader
loader
pup
linkury
trojan
evasion
stealer
arkei
vidar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D958128B39C659B1E202811C64421305

SHA1:

0AE0C0CF03E493527696275B945AE0D8B2FC389E

SHA256:

D454FD6CDC94C57517B2FE952EC2D066C7734E1D3051D8C116B90985EDBDE1C8

SSDEEP:

24576:s3oBpoD1mSYIUOCh7hZ3MXH0oyoNIWiBZxzt/Z9j1eBbKQYvKs/4SJVeI4:nB+D4XoCQyoCXxf9j1eeVwKF4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ICLOADER was detected

      • Advanced.exe (PID: 2740)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 3816)
      • Tstp.exe (PID: 2556)
      • speedycar.exe (PID: 3412)
      • fastdatax.exe (PID: 3192)
      • fastdatax.exe (PID: 3488)
      • installer_mi.exe (PID: 2660)
      • 348508141.exe (PID: 3528)
      • installer.exe (PID: 3100)
      • yb2.exe (PID: 3764)
      • whiteclick.exe (PID: 2544)
      • yb2.exe (PID: 3368)
      • Zuneco.bin (PID: 3744)
      • Nettrans.exe (PID: 3340)
      • Nettrans.exe (PID: 2476)
      • Nettrans.exe (PID: 4020)
      • hsunzkgfuyp.exe (PID: 2464)
      • unins000.exe (PID: 2156)
      • Nettrans.exe (PID: 3976)
      • _iu14D2N.tmp (PID: 3004)
      • 348508141.exe (PID: 3628)
      • msiexec.exe (PID: 2824)
      • msiexec.exe (PID: 2088)
      • MsiExec.exe (PID: 4000)
      • Medtouch.exe (PID: 3000)
      • 348508141.exe (PID: 2084)
      • Tolnix.exe (PID: 3328)
      • EkidrNfdXEjphFdI.exe (PID: 3428)
      • Speedycar.exe (PID: 2388)
      • Biofax.bin (PID: 4012)
      • LogicHandler.exe (PID: 2496)
      • LogicHandler.exe (PID: 2748)
      • set.exe (PID: 2392)
      • Tolnix.exe (PID: 3028)
      • Tolnix.exe (PID: 5840)
      • Tolnix.exe (PID: 4324)
      • Tolnix.exe (PID: 4984)

    • Downloads executable files from the Internet

      • Advanced.exe (PID: 2740)
      • setup.exe (PID: 3816)

    • Connects to CnC server

      • setup.exe (PID: 3816)
      • fastdatax.tmp (PID: 2152)
      • fastdatax.tmp (PID: 1956)
      • installer.tmp (PID: 3884)
      • Medtouch.exe (PID: 3000)
      • Tolnix.exe (PID: 3328)
      • set.exe (PID: 2392)

    • LINKURY was detected

      • setup.exe (PID: 3816)
      • Nettrans.exe (PID: 4020)
      • Medtouch.exe (PID: 3000)
      • Tolnix.exe (PID: 3328)
      • LogicHandler.exe (PID: 2496)
      • set.exe (PID: 2392)

    • Loads the Task Scheduler DLL interface

      • schtasks.exe (PID: 3888)
      • schtasks.exe (PID: 2240)
      • schtasks.exe (PID: 3844)

    • Uses Task Scheduler to run other applications

      • yb2.exe (PID: 3764)
      • installer_mi.exe (PID: 2660)
      • EkidrNfdXEjphFdI.exe (PID: 3428)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 2712)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 2632)
      • cmd.exe (PID: 2628)
      • cmd.exe (PID: 3196)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 4364)
      • cmd.exe (PID: 4612)
      • cmd.exe (PID: 4696)
      • cmd.exe (PID: 5644)
      • cmd.exe (PID: 6040)
      • cmd.exe (PID: 4312)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 5020)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 5936)
      • rundll32.exe (PID: 5012)
      • cmd.exe (PID: 5188)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 5100)
      • cmd.exe (PID: 6124)
      • cmd.exe (PID: 3228)
      • cmd.exe (PID: 4824)
      • cmd.exe (PID: 6060)
      • cmd.exe (PID: 6080)
      • cmd.exe (PID: 5660)
      • cmd.exe (PID: 4592)
      • cmd.exe (PID: 4976)
      • cmd.exe (PID: 4796)
      • cmd.exe (PID: 4668)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 5092)
      • cmd.exe (PID: 5648)

    • Starts NET.EXE for service management

      • installer.tmp (PID: 3884)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2188)
      • schtasks.exe (PID: 3256)
      • schtasks.exe (PID: 3772)
      • schtasks.exe (PID: 3708)
      • schtasks.exe (PID: 2244)
      • schtasks.exe (PID: 2564)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 2472)
      • schtasks.exe (PID: 3456)
      • schtasks.exe (PID: 3284)
      • schtasks.exe (PID: 3336)
      • schtasks.exe (PID: 3332)
      • schtasks.exe (PID: 4048)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 3788)
      • schtasks.exe (PID: 2512)
      • schtasks.exe (PID: 2164)
      • schtasks.exe (PID: 3968)
      • schtasks.exe (PID: 1440)
      • schtasks.exe (PID: 3640)
      • schtasks.exe (PID: 3220)
      • schtasks.exe (PID: 2308)
      • schtasks.exe (PID: 2208)
      • schtasks.exe (PID: 3820)
      • schtasks.exe (PID: 2212)
      • schtasks.exe (PID: 2448)
      • schtasks.exe (PID: 2320)
      • schtasks.exe (PID: 3692)
      • schtasks.exe (PID: 2436)
      • schtasks.exe (PID: 2640)
      • schtasks.exe (PID: 3676)
      • schtasks.exe (PID: 4036)
      • schtasks.exe (PID: 4296)
      • schtasks.exe (PID: 5612)
      • schtasks.exe (PID: 4264)
      • schtasks.exe (PID: 4272)
      • schtasks.exe (PID: 5112)
      • schtasks.exe (PID: 5496)
      • schtasks.exe (PID: 4460)
      • schtasks.exe (PID: 4160)
      • schtasks.exe (PID: 5352)
      • schtasks.exe (PID: 6088)
      • schtasks.exe (PID: 5548)
      • schtasks.exe (PID: 5256)
      • schtasks.exe (PID: 4804)
      • schtasks.exe (PID: 4216)
      • schtasks.exe (PID: 4488)
      • schtasks.exe (PID: 5544)
      • schtasks.exe (PID: 5444)
      • schtasks.exe (PID: 5704)
      • schtasks.exe (PID: 5428)
      • schtasks.exe (PID: 4888)
      • schtasks.exe (PID: 5248)
      • schtasks.exe (PID: 5372)
      • schtasks.exe (PID: 4924)
      • schtasks.exe (PID: 4288)
      • schtasks.exe (PID: 5304)
      • schtasks.exe (PID: 5636)
      • schtasks.exe (PID: 4644)
      • schtasks.exe (PID: 5744)
      • schtasks.exe (PID: 5596)
      • schtasks.exe (PID: 4328)
      • schtasks.exe (PID: 5116)
      • schtasks.exe (PID: 6092)
      • schtasks.exe (PID: 5192)
      • schtasks.exe (PID: 6112)
      • schtasks.exe (PID: 5904)
      • schtasks.exe (PID: 5332)
      • schtasks.exe (PID: 4452)

    • Changes settings of System certificates

      • 348508141.exe (PID: 3528)

    • ARKEI was detected

      • Tstp.exe (PID: 2556)

    • Loads dropped or rewritten executable

      • _iu14D2N.tmp (PID: 3004)
      • Speedycar.exe (PID: 2388)
      • Tolnix.exe (PID: 3328)
      • schtasks.exe (PID: 3640)
      • schtasks.exe (PID: 3968)
      • conhost.exe (PID: 3032)
      • schtasks.exe (PID: 3220)
      • conhost.exe (PID: 2768)
      • schtasks.exe (PID: 2308)
      • conhost.exe (PID: 2892)
      • conhost.exe (PID: 2788)
      • cmd.exe (PID: 2628)
      • schtasks.exe (PID: 3820)
      • LogicHandler.exe (PID: 2748)
      • schtasks.exe (PID: 2212)
      • conhost.exe (PID: 3740)
      • conhost.exe (PID: 2600)
      • conhost.exe (PID: 3188)
      • schtasks.exe (PID: 2448)
      • cmd.exe (PID: 3196)
      • cmd.exe (PID: 3700)
      • conhost.exe (PID: 2444)
      • schtasks.exe (PID: 2320)
      • conhost.exe (PID: 2328)
      • schtasks.exe (PID: 3692)
      • conhost.exe (PID: 3112)
      • conhost.exe (PID: 2920)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 2772)
      • schtasks.exe (PID: 2436)
      • schtasks.exe (PID: 2640)
      • regedit.exe (PID: 3260)
      • schtasks.exe (PID: 3676)
      • schtasks.exe (PID: 2240)
      • conhost.exe (PID: 2680)
      • set.exe (PID: 2392)
      • wmiprvse.exe (PID: 2620)
      • chrome.exe (PID: 2540)
      • conhost.exe (PID: 3464)
      • chrome.exe (PID: 2376)
      • conhost.exe (PID: 2776)
      • conhost.exe (PID: 2908)
      • schtasks.exe (PID: 3844)
      • cmd.exe (PID: 3664)
      • conhost.exe (PID: 4468)
      • schtasks.exe (PID: 4036)
      • cmd.exe (PID: 4364)
      • conhost.exe (PID: 4864)
      • cmd.exe (PID: 4612)
      • schtasks.exe (PID: 4264)
      • conhost.exe (PID: 4848)
      • conhost.exe (PID: 5164)
      • rundll32.EXE (PID: 4100)
      • schtasks.exe (PID: 4272)
      • cmd.exe (PID: 4696)
      • conhost.exe (PID: 5796)
      • schtasks.exe (PID: 4296)
      • schtasks.exe (PID: 5612)
      • schtasks.exe (PID: 5112)
      • conhost.exe (PID: 5916)
      • conhost.exe (PID: 4628)
      • taskeng.exe (PID: 5376)
      • cmd.exe (PID: 5644)
      • conhost.exe (PID: 4336)
      • schtasks.exe (PID: 4460)
      • schtasks.exe (PID: 5496)
      • Tolnix.exe (PID: 3028)
      • cmd.exe (PID: 6040)
      • conhost.exe (PID: 4780)
      • schtasks.exe (PID: 4160)
      • cmd.exe (PID: 4312)
      • schtasks.exe (PID: 6088)
      • conhost.exe (PID: 5592)
      • regedit.exe (PID: 5896)
      • schtasks.exe (PID: 5352)
      • conhost.exe (PID: 5964)
      • conhost.exe (PID: 4852)
      • cmd.exe (PID: 5344)
      • schtasks.exe (PID: 5548)
      • schtasks.exe (PID: 5256)
      • conhost.exe (PID: 5068)
      • conhost.exe (PID: 4404)
      • cmd.exe (PID: 5020)
      • schtasks.exe (PID: 4804)
      • schtasks.exe (PID: 4216)
      • conhost.exe (PID: 5388)
      • Tolnix.exe (PID: 5840)
      • schtasks.exe (PID: 4488)
      • conhost.exe (PID: 4492)
      • cmd.exe (PID: 4112)
      • schtasks.exe (PID: 5544)
      • conhost.exe (PID: 4196)
      • cmd.exe (PID: 5936)
      • conhost.exe (PID: 4908)
      • schtasks.exe (PID: 5704)
      • schtasks.exe (PID: 5444)
      • rundll32.exe (PID: 5012)
      • SearchProtocolHost.exe (PID: 5240)
      • conhost.exe (PID: 5564)
      • schtasks.exe (PID: 5428)
      • werfault.exe (PID: 5540)
      • DllHost.exe (PID: 5816)
      • conhost.exe (PID: 4576)
      • SearchFilterHost.exe (PID: 4956)
      • cmd.exe (PID: 5188)
      • schtasks.exe (PID: 4888)
      • schtasks.exe (PID: 5248)
      • chrome.exe (PID: 4320)
      • chrome.exe (PID: 5608)
      • cmd.exe (PID: 4108)
      • conhost.exe (PID: 5324)
      • conhost.exe (PID: 5184)
      • chrome.exe (PID: 4884)
      • chrome.exe (PID: 5488)
      • conhost.exe (PID: 2700)
      • conhost.exe (PID: 4700)
      • schtasks.exe (PID: 5372)
      • chrome.exe (PID: 4660)
      • timeout.exe (PID: 6116)
      • conhost.exe (PID: 4260)
      • cmd.exe (PID: 4408)
      • conhost.exe (PID: 2468)
      • chrome.exe (PID: 4284)
      • chrome.exe (PID: 5216)
      • schtasks.exe (PID: 4924)
      • chrome.exe (PID: 5032)
      • cmd.exe (PID: 5100)
      • cmd.exe (PID: 6124)
      • cmd.exe (PID: 3440)
      • schtasks.exe (PID: 4288)
      • regedit.exe (PID: 4560)
      • schtasks.exe (PID: 5304)
      • werfault.exe (PID: 4596)
      • chrome.exe (PID: 4752)
      • chrome.exe (PID: 3972)
      • conhost.exe (PID: 5772)
      • DllHost.exe (PID: 5316)
      • cmd.exe (PID: 3228)
      • schtasks.exe (PID: 5636)
      • conhost.exe (PID: 3208)
      • chrome.exe (PID: 2232)
      • cmd.exe (PID: 4824)
      • conhost.exe (PID: 4104)
      • conhost.exe (PID: 5336)
      • cmd.exe (PID: 6080)
      • cmd.exe (PID: 6060)
      • regedit.exe (PID: 4588)
      • schtasks.exe (PID: 5744)
      • schtasks.exe (PID: 5596)
      • conhost.exe (PID: 6012)
      • cmd.exe (PID: 5660)
      • schtasks.exe (PID: 4644)
      • schtasks.exe (PID: 5192)
      • cmd.exe (PID: 4592)
      • conhost.exe (PID: 4708)
      • Tolnix.exe (PID: 4324)
      • conhost.exe (PID: 4940)
      • cmd.exe (PID: 4976)
      • schtasks.exe (PID: 5116)
      • schtasks.exe (PID: 6092)
      • conhost.exe (PID: 4276)
      • cmd.exe (PID: 4796)
      • schtasks.exe (PID: 4328)
      • schtasks.exe (PID: 6112)
      • conhost.exe (PID: 5492)
      • cmd.exe (PID: 6036)
      • Tolnix.exe (PID: 4984)
      • conhost.exe (PID: 4640)
      • schtasks.exe (PID: 5904)
      • cmd.exe (PID: 5092)
      • schtasks.exe (PID: 5332)
      • DllHost.exe (PID: 4308)
      • werfault.exe (PID: 5180)
      • conhost.exe (PID: 5740)
      • cmd.exe (PID: 4668)
      • cmd.exe (PID: 5648)
      • schtasks.exe (PID: 4452)
      • conhost.exe (PID: 4304)

    • Changes the autorun value in the registry

      • 348508141.exe (PID: 3628)
      • hsunzkgfuyp.tmp (PID: 3500)
      • regedit.exe (PID: 2852)
      • regedit.exe (PID: 3260)
      • regedit.exe (PID: 5896)
      • Advanced.exe (PID: 2740)
      • regedit.exe (PID: 4560)
      • regedit.exe (PID: 4588)

    • Writes to a start menu file

      • msiexec.exe (PID: 2088)

    • Changes AppInit_DLLs value (autorun option)

      • regedit.exe (PID: 2852)
      • regedit.exe (PID: 3260)
      • regedit.exe (PID: 5896)
      • regedit.exe (PID: 4560)
      • regedit.exe (PID: 4588)

    • Changes internet zones settings

      • EkidrNfdXEjphFdI.exe (PID: 3428)

    • Modifies files in Chrome extension folder

      • EkidrNfdXEjphFdI.exe (PID: 3428)

  • SUSPICIOUS

    • Creates files in the user directory

      • Advanced.exe (PID: 2740)
      • installer.tmp (PID: 3884)
      • msiexec.exe (PID: 2088)
      • Tolnix.exe (PID: 3328)
      • EkidrNfdXEjphFdI.exe (PID: 3428)

    • Reads Internet Cache Settings

      • Advanced.exe (PID: 2740)

    • Executable content was dropped or overwritten

      • Advanced.exe (PID: 2740)
      • fastdatax.tmp (PID: 2152)
      • fastdatax.exe (PID: 3192)
      • speedycar.exe (PID: 3412)
      • speedycar.tmp (PID: 2836)
      • fastdatax.exe (PID: 3488)
      • fastdatax.tmp (PID: 1956)
      • installer.exe (PID: 3100)
      • installer.tmp (PID: 3884)
      • whiteclick.exe (PID: 2544)
      • whiteclick.tmp (PID: 2596)
      • 348508141.exe (PID: 3528)
      • msiexec.exe (PID: 2088)
      • setup.exe (PID: 3816)
      • Zuneco.bin (PID: 3744)
      • hsunzkgfuyp.exe (PID: 2464)
      • installer_mi.exe (PID: 2660)
      • unins000.exe (PID: 2156)
      • _iu14D2N.tmp (PID: 3004)
      • hsunzkgfuyp.tmp (PID: 3500)
      • Medtouch.exe (PID: 3000)
      • Biofax.bin (PID: 4012)
      • yb2.exe (PID: 3764)
      • Tolnix.exe (PID: 3328)
      • LogicHandler.exe (PID: 2748)
      • EkidrNfdXEjphFdI.exe (PID: 3428)
      • rundll32.EXE (PID: 4100)

    • Reads the Windows organization settings

      • fastdatax.tmp (PID: 2152)
      • fastdatax.tmp (PID: 1956)
      • installer.tmp (PID: 3884)
      • _iu14D2N.tmp (PID: 3004)

    • Reads internet explorer settings

      • Advanced.exe (PID: 2740)

    • Reads Windows owner or organization settings

      • fastdatax.tmp (PID: 2152)
      • fastdatax.tmp (PID: 1956)
      • installer.tmp (PID: 3884)
      • _iu14D2N.tmp (PID: 3004)

    • Uses TASKKILL.EXE to kill Browsers

      • installer.tmp (PID: 3884)

    • Creates files in the Windows directory

      • schtasks.exe (PID: 3888)
      • cmd.exe (PID: 2916)
      • installer_mi.exe (PID: 2660)
      • msiexec.exe (PID: 2088)
      • 348508141.exe (PID: 3528)
      • Tolnix.exe (PID: 3328)
      • schtasks.exe (PID: 2240)
      • schtasks.exe (PID: 3844)
      • set.exe (PID: 2392)

    • Adds / modifies Windows certificates

      • 348508141.exe (PID: 3528)

    • Uses TASKKILL.EXE to kill process

      • installer.tmp (PID: 3884)
      • cmd.exe (PID: 2576)

    • Starts Microsoft Installer

      • whiteclick.tmp (PID: 2596)

    • Starts application with an unusual extension

      • setup.exe (PID: 3816)
      • unins000.exe (PID: 2156)

    • Starts CMD.EXE for commands execution

      • Nettrans.exe (PID: 3340)
      • yb2.exe (PID: 3368)
      • Nettrans.exe (PID: 2476)
      • Tstp.exe (PID: 2556)
      • Nettrans.exe (PID: 3976)
      • fastdatax.tmp (PID: 2152)
      • fastdatax.tmp (PID: 1956)
      • Tolnix.exe (PID: 3328)
      • LogicHandler.exe (PID: 2748)
      • Tolnix.exe (PID: 3028)
      • Advanced.exe (PID: 2740)
      • Tolnix.exe (PID: 5840)
      • Tolnix.exe (PID: 4324)
      • Tolnix.exe (PID: 4984)

    • Creates files in the program directory

      • Zuneco.bin (PID: 3744)
      • Nettrans.exe (PID: 4020)
      • installer_mi.exe (PID: 2660)
      • Medtouch.exe (PID: 3000)
      • Tolnix.exe (PID: 3328)
      • LogicHandler.exe (PID: 2496)
      • LogicHandler.exe (PID: 2748)
      • setup.exe (PID: 3816)
      • EkidrNfdXEjphFdI.exe (PID: 3428)
      • chrome.exe (PID: 5488)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2264)
      • cmd.exe (PID: 2924)
      • cmd.exe (PID: 2532)
      • Medtouch.exe (PID: 3000)
      • cmd.exe (PID: 3700)
      • LogicHandler.exe (PID: 2748)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3980)
      • cmd.exe (PID: 4056)
      • wscript.exe (PID: 1488)

    • Executes scripts

      • yb2.exe (PID: 3368)

    • Executes application which crashes

      • cmd.exe (PID: 3992)

    • Starts itself from another location

      • unins000.exe (PID: 2156)
      • setup.exe (PID: 3816)
      • yb2.exe (PID: 3764)

    • Application launched itself

      • 348508141.exe (PID: 3528)
      • 348508141.exe (PID: 3628)
      • LogicHandler.exe (PID: 2496)
      • rundll32.EXE (PID: 4100)

    • Creates a software uninstall entry

      • _iu14D2N.tmp (PID: 3004)
      • setup.exe (PID: 3816)
      • EkidrNfdXEjphFdI.exe (PID: 3428)

    • Removes files from Windows directory

      • yb2.exe (PID: 3368)
      • Tolnix.exe (PID: 3328)
      • set.exe (PID: 2392)

    • Creates COM task schedule object

      • MsiExec.exe (PID: 4000)
      • EkidrNfdXEjphFdI.exe (PID: 3428)

    • Changes the started page of IE

      • Tolnix.exe (PID: 3328)

    • Changes IE settings (feature browser emulation)

      • EkidrNfdXEjphFdI.exe (PID: 3428)

    • Uses RUNDLL32.EXE to load library

      • rundll32.EXE (PID: 4100)

  • INFO

    • Loads dropped or rewritten executable

      • fastdatax.tmp (PID: 2152)
      • speedycar.tmp (PID: 2836)
      • fastdatax.tmp (PID: 1956)
      • installer.tmp (PID: 3884)
      • msiexec.exe (PID: 2088)
      • MsiExec.exe (PID: 4000)

    • Application was dropped or rewritten from another process

      • fastdatax.tmp (PID: 2152)
      • speedycar.tmp (PID: 2836)
      • fastdatax.tmp (PID: 1956)
      • DocRDV.exe (PID: 4068)
      • installer.tmp (PID: 3884)
      • whiteclick.tmp (PID: 2596)
      • hsunzkgfuyp.tmp (PID: 3500)

    • Creates a software uninstall entry

      • fastdatax.tmp (PID: 2152)
      • fastdatax.tmp (PID: 1956)
      • installer.tmp (PID: 3884)
      • hsunzkgfuyp.tmp (PID: 3500)
      • msiexec.exe (PID: 2088)

    • Creates files in the program directory

      • speedycar.tmp (PID: 2836)
      • installer.tmp (PID: 3884)
      • fastdatax.tmp (PID: 1956)
      • hsunzkgfuyp.tmp (PID: 3500)

    • Application launched itself

      • chrome.exe (PID: 3680)
      • msiexec.exe (PID: 2088)
      • chrome.exe (PID: 2540)
      • chrome.exe (PID: 4320)
      • chrome.exe (PID: 5488)

    • Dropped object may contain Bitcoin addresses

      • hsunzkgfuyp.tmp (PID: 3500)
      • msiexec.exe (PID: 2088)

    • Application was crashed

      • installer_mi.exe (PID: 2660)

    • Connects to unusual port

      • chrome.exe (PID: 5488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Clipper DOS Executable (33.5)
.exe | Generic Win/DOS Executable (33.2)
.exe | DOS Executable Generic (33.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:02:25 12:02:06+01:00
PEType: PE32
LinkerVersion: 10.13
CodeSize: 1101312
InitializedDataSize: 798208
UninitializedDataSize: -
EntryPoint: 0x10a730
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.422.0.129
ProductVersionNumber: 3.422.0.129
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (Australian)
CharacterSet: Unicode
FileVersion: 3.422.0.129
ProductVersion: 3.422.0.129
FileDescription: setup

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Feb-2019 11:02:06
Detected languages:
  • English - Australia
  • English - Canada
  • English - United Kingdom
  • English - United States
  • Process Default Language
Debug artifacts:
  • Embedded COFF debugging symbols
FileVersion: 3.422.0.129
ProductVersion: 3.422.0.129
FileDescription: setup

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000078

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 25-Feb-2019 11:02:06
Pointer to Symbol Table: 0x0000168A
Number of symbols: 5770
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_AGGRESIVE_WS_TRIM
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0010CD68
0x0010CE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.51618
.rdata
0x0010E000
0x00000CA8
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.09125
.data
0x0010F000
0x0002C4BC
0x00002600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.640363
.rsrc
0x0013C000
0x00095A00
0x00095A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.33205

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.94998
209
UNKNOWN
English - United States
RT_MANIFEST
2
4
16
UNKNOWN
UNKNOWN
RT_RCDATA
3
5.17906
336
UNKNOWN
UNKNOWN
RT_RCDATA
4
1.77487
308
UNKNOWN
English - United States
RT_CURSOR
5
4.56808
44
UNKNOWN
UNKNOWN
RT_RCDATA
6
2.17157
308
UNKNOWN
English - United States
RT_CURSOR
7
2.29812
308
UNKNOWN
English - United States
RT_CURSOR
8
2.46308
308
UNKNOWN
English - United States
RT_CURSOR
9
3.59889
308
UNKNOWN
English - United States
RT_CURSOR
10
2.22891
308
UNKNOWN
English - United States
RT_CURSOR

Imports

ADVAPI32.dll
KERNEL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
417
Monitored processes
307
Malicious processes
71
Suspicious processes
61

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start #ICLOADER advanced.exe #LINKURY setup.exe fastdatax.exe fastdatax.tmp #ARKEI tstp.exe speedycar.exe speedycar.tmp docrdv.exe no specs installer_mi.exe fastdatax.exe fastdatax.tmp installer.exe 348508141.exe installer.tmp yb2.exe whiteclick.exe schtasks.exe no specs whiteclick.tmp taskkill.exe no specs schtasks.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs net.exe no specs msiexec.exe no specs net1.exe no specs net1.exe no specs yb2.exe no specs msiexec.exe chrome.exe no specs gpupdate.exe no specs chrome.exe no specs chrome.exe no specs taskkill.exe no specs zuneco.bin nettrans.exe no specs msiexec.exe no specs cmd.exe no specs sc.exe no specs nettrans.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs sc.exe no specs reg.exe no specs #LINKURY nettrans.exe cmd.exe no specs cmd.exe no specs hsunzkgfuyp.exe cmd.exe no specs unins000.exe wscript.exe no specs nettrans.exe no specs ntvdm.exe no specs hsunzkgfuyp.tmp _iu14d2n.tmp taskkill.exe no specs 348508141.exe cmd.exe no specs sc.exe no specs schtasks.exe no specs reg.exe no specs #LINKURY medtouch.exe schtasks.exe no specs 348508141.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs timeout.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs timeout.exe no specs reg.exe no specs #LINKURY tolnix.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ekidrnfdxejphfdi.exe schtasks.exe no specs schtasks.exe no specs speedycar.exe no specs biofax.bin schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #LINKURY logichandler.exe cmd.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs schtasks.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs logichandler.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs #LINKURY set.exe wmiprvse.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs rundll32.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs taskeng.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs tolnix.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs regedit.exe conhost.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs tolnix.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs rundll32.exe no specs searchprotocolhost.exe no specs schtasks.exe no specs conhost.exe no specs werfault.exe no specs Thumbnail Cache Out of Proc Server no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs searchfilterhost.exe no specs conhost.exe no specs schtasks.exe no specs chrome.exe chrome.exe no specs chrome.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs cmd.exe no specs schtasks.exe no specs timeout.exe no specs conhost.exe no specs chrome.exe no specs cmd.exe no specs chrome.exe no specs cmd.exe no specs chrome.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs regedit.exe schtasks.exe no specs chrome.exe no specs werfault.exe no specs chrome.exe no specs Thumbnail Cache Out of Proc Server no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs chrome.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs tolnix.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs tolnix.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs Thumbnail Cache Out of Proc Server no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs advanced.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
936sc create "backlh" binPath= "C:\ProgramData\Logic Cramble\set.exe" DisplayName= "Background Logic Handler" start= "auto"C:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
1440SCHTASKS /Query /TN "psv_Sol-Lam"C:\Windows\system32\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1488wscript C:\Windows\Temp\CRbmyuXVrThPbSbF\afRreeeSHbIAWRXY.vbsC:\Windows\system32\wscript.exe—yb2.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1616C:\Windows\system32\net1 stop gupdateC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1940"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Administrator\AppData\Local\Temp\nNxWrSPqpNrwsoEyy" /t REG_DWORD /d 0C:\Windows\System32\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1956"C:\Users\admin\AppData\Local\Temp\is-UQ1BK.tmp\fastdatax.tmp" /SL5="$2019C,971117,121344,C:\Users\admin\AppData\Local\Temp\fastdatax.exe" /VERYSILENT /SL5="$1014E,971117,121344,C:\Users\admin\AppData\Local\Temp\fastdatax.exe" /source_id=92C:\Users\admin\AppData\Local\Temp\is-UQ1BK.tmp\fastdatax.tmp
fastdatax.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-uq1bk.tmp\fastdatax.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2036"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\admin\AppData\LocalLow\bMjFhvtVUwkKS" /t REG_DWORD /d 0C:\Windows\System32\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084"C:\Program Files\SETUP\348508141.exe" 2 3.1551093304.5c73ce3826c08C:\Program Files\SETUP\348508141.exe
348508141.exe
User:
admin
Company:
Files Manager
Integrity Level:
HIGH
Description:
Folders
Exit code:
0
Version:
5.7.6.9
Modules
Images
c:\program files\setup\348508141.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2088C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
4 810
Read events
3 856
Write events
900
Delete events
54

Modification events

(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2740) Advanced.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Advanced_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
96
Suspicious files
58
Text files
326
Unknown types
51

Dropped files

PID
Process
Filename
Type
3816setup.exeC:\Users\admin\AppData\Local\sha.dbsqlite
MD5:—
SHA256:—
2740Advanced.exeC:\Users\admin\AppData\Local\Temp\Advanced SystemCare Pro 12.2.0.315 Crack Serial Kehtml
MD5:—
SHA256:—
3816setup.exeC:\Users\admin\AppData\Local\installer.datbinary
MD5:—
SHA256:—
2740Advanced.exeC:\Users\admin\AppData\Local\Temp\setup.exeexecutable
MD5:—
SHA256:—
2740Advanced.exeC:\Users\admin\Downloads\Играть в Neverwinter.icoimage
MD5:—
SHA256:—
3816setup.exeC:\Users\admin\AppData\Local\InstallationConfiguration.xmltext
MD5:—
SHA256:—
2836speedycar.tmpC:\Users\admin\AppData\Local\Temp\is-CD4KG.tmp\is-0LEMS.tmp —
MD5:—
SHA256:—
2740Advanced.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019022520190226\index.datdat
MD5:—
SHA256:—
2836speedycar.tmpC:\Users\admin\AppData\Local\Temp\is-CD4KG.tmp\is-1EJD0.tmp —
MD5:—
SHA256:—
2740Advanced.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\offer[1].txthtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
176
TCP/UDP connections
72
DNS requests
53
Threats
246

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2740
Advanced.exe
POST
200
95.216.179.32:80
http://static.32.179.216.95.clients.your-server.de/request/autok?user=luxsoft&ver=10&key=a8d588afe11b4f83598303abd1b1afc3
DE
text
140 b
malicious
2740
Advanced.exe
POST
200
95.216.179.32:80
http://static.32.179.216.95.clients.your-server.de/request/offers?user=luxsoft&ver=10&key=5566a690fe44d36b9cee3262837f5eff&token=e88792895835d9eb6cf803dc6cf3028e
DE
text
10.2 Kb
malicious
2740
Advanced.exe
GET
200
162.144.221.178:80
http://www.getgosoft.com/getgodm/thankyou
US
html
12.2 Kb
suspicious
2740
Advanced.exe
POST
200
95.216.179.32:80
http://static.32.179.216.95.clients.your-server.de/request/conditions?user=luxsoft&ver=10&key=07440e8814b41e10b48558af594b2601&token=e88792895835d9eb6cf803dc6cf3028e
DE
text
11.4 Kb
malicious
2740
Advanced.exe
GET
200
95.216.179.32:80
http://static.32.179.216.95.clients.your-server.de/api/installer/offer?component_id=131582&token=e88792895835d9eb6cf803dc6cf3028e
DE
html
903 b
malicious
2740
Advanced.exe
GET
200
104.24.127.128:80
http://img.wait3sec.com/images/neverwinter.ico
US
image
121 Kb
shared
2740
Advanced.exe
GET
200
95.216.179.32:80
http://static.32.179.216.95.clients.your-server.de/request/get/e88792895835d9eb6cf803dc6cf3028e/131240
DE
executable
1.33 Mb
malicious
2740
Advanced.exe
GET
200
95.216.179.32:80
http://static.32.179.216.95.clients.your-server.de/request/get/e88792895835d9eb6cf803dc6cf3028e/131634
DE
executable
180 Kb
malicious
2740
Advanced.exe
GET
200
104.24.127.128:80
http://img.wait3sec.com/images/neverwinter.ico
US
image
121 Kb
shared
3816
setup.exe
GET
200
13.66.51.223:80
http://svc-stats.linkury.com/StateStatisticsService.svc/V1/JSON/GetDistributorIdFromNameHttpGet?distributorName=APSFEM
US
text
13 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
fastdatax.tmp
104.18.39.90:80
tm1.fastdataxew.info
Cloudflare Inc
US
shared
2740
Advanced.exe
95.216.179.32:80
static.32.179.216.95.clients.your-server.de
Hetzner Online GmbH
DE
malicious
2740
Advanced.exe
162.144.221.178:80
www.getgosoft.com
Unified Layer
US
suspicious
2740
Advanced.exe
52.174.148.190:80
install.osxappdownload.com
Microsoft Corporation
NL
whitelisted
2740
Advanced.exe
104.24.127.128:80
img.wait3sec.com
Cloudflare Inc
US
shared
3816
setup.exe
13.66.51.223:80
svc-stats.linkury.com
Microsoft Corporation
US
whitelisted
2740
Advanced.exe
69.16.175.10:80
cds.n2z8d3h8.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
3816
setup.exe
52.174.148.190:80
install.osxappdownload.com
Microsoft Corporation
NL
whitelisted
3816
setup.exe
65.52.32.169:80
madmax.utyuytjn.com
Microsoft Corporation
US
whitelisted
2556
Tstp.exe
81.177.140.221:80
upyourtext.com
JSC RTComm.RU
RU
malicious

DNS requests

Domain
IP
Reputation
static.32.179.216.95.clients.your-server.de
  • 95.216.179.32
malicious
install.osxappdownload.com
  • 52.174.148.190
malicious
www.getgosoft.com
  • 162.144.221.178
unknown
cds.n2z8d3h8.hwcdn.net
  • 69.16.175.10
  • 69.16.175.42
whitelisted
img.wait3sec.com
  • 104.24.127.128
  • 104.24.126.128
shared
svc-stats.linkury.com
  • 13.66.51.223
shared
madmax.utyuytjn.com
  • 65.52.32.169
unknown
updates.utyuytjn.com
  • 52.174.148.190
unknown
stats.utyuytjn.com
  • 13.66.51.223
unknown
upyourtext.com
  • 81.177.140.221
malicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Luxsoft Win32/ICLoader User-Agent
—
—
Misc activity
ADWARE [PTsecurity] Application.Bundler.ICLoader Response
—
—
A Network Trojan was detected
ET MALWARE Luxsoft Win32/ICLoader User-Agent
—
—
A Network Trojan was detected
ET MALWARE Luxsoft Win32/ICLoader User-Agent
—
—
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Misc activity
ADWARE [PTsecurity] PUP.Optional.LogicHandler
—
—
A Network Trojan was detected
ET MALWARE Luxsoft Win32/ICLoader User-Agent
203 ETPRO signatures available at the full report
Process
Message
Medtouch.exe
DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFEM ChannelId=3 BarcodeId=54856003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Tolnix YBSearch=false ApName=Tolnix SetAll=true pid=721 sid=160689637_131582
Tolnix.exe
Agent Main
Tolnix.exe
Agent Started
Tolnix.exe
Agent service started with arg: DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFEM ChannelId=3 BarcodeId=54856003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Tolnix YBSearch=false ApName=Tolnix SetAll=true pid=721 sid=160689637_131582
Tolnix.exe
Current directory: C:\ProgramData\Tolnix
Tolnix.exe
*****************************************************************
Tolnix.exe
Create file context remotely : Path = C:\ProgramData\Tolnix\Tolnix.d.dat, Version = 3.0.0.26
Tolnix.exe
*****************************************************************
Tolnix.exe
*****************************************************************
Tolnix.exe
Create file context remotely : Path = C:\ProgramData\Tolnix\Tolnix.dat, Version = 7.4.125.0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Advanced.exe