URL:

http://update.downloaditop.com/dl/action-center/iTopF540-20240322.exe

Full analysis: https://app.any.run/tasks/03f744f9-fe3a-4ac1-aca5-6d0073e07f75
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 04, 2024, 15:59:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
Indicators:
MD5:

C2AD78F97010F57F1F84A22683091075

SHA1:

EA884695E0C29F7DD7F9990D38D30B914C93D43F

SHA256:

DB91E939F85F2392130F8EDA566DFEA475BE59AF17115062EBE2FDFA78D8CF50

SSDEEP:

3:N1KLQRAAEKRRKgK/uxLbKGR2V9Cn:CUfEyKmFRy9Cn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iTopF540-20240322.exe (PID: 2152)
      • iTopF540-20240322.exe (PID: 1808)
      • iTopF540-20240322.tmp (PID: 3324)
      • iTopF540-20240322.exe (PID: 924)
      • iTopF540-20240322.tmp (PID: 2568)
      • ugin.exe (PID: 4092)
      • iTopDownloader.exe (PID: 3268)
      • iTopDataRecovery.exe (PID: 3816)
      • atud.exe (PID: 3428)
      • iTopDataRecovery.tmp (PID: 3288)
      • Autoupdate.exe (PID: 2104)

    • Application was injected by another process

      • explorer.exe (PID: 1164)

    • Runs injected code in another process

      • icop32.exe (PID: 1428)
      • ICONPIN32.exe (PID: 3048)

    • Steals credentials from Web Browsers

      • iTopVPN.exe (PID: 3876)

    • Actions looks like stealing of personal data

      • iTopVPN.exe (PID: 3876)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • iTopF540-20240322.tmp (PID: 3324)
      • iTopF540-20240322.tmp (PID: 2568)
      • iTopDataRecovery.tmp (PID: 3288)

    • Reads the Windows owner or organization settings

      • iTopF540-20240322.tmp (PID: 3324)
      • iTopF540-20240322.tmp (PID: 2568)
      • iTopDataRecovery.tmp (PID: 3288)

    • Reads security settings of Internet Explorer

      • iTopF540-20240322.tmp (PID: 3324)
      • iTopF540-20240322.tmp (PID: 2568)
      • ugin.exe (PID: 4092)
      • Setup.exe (PID: 2484)
      • iTopVPN.exe (PID: 3876)
      • iTopDownloader.exe (PID: 3268)
      • iTopDataRecovery.tmp (PID: 3288)
      • IdrInit.exe (PID: 3940)
      • iTopDataRecovery.exe (PID: 3448)
      • Autoupdate.exe (PID: 2104)
      • atud.exe (PID: 3428)
      • onlinesr_en.exe (PID: 3204)

    • Checks for external IP

      • ugin.exe (PID: 2724)
      • ugin.exe (PID: 4092)
      • unpr.exe (PID: 2980)
      • UninstallInfo.exe (PID: 920)
      • itopeasterp24.exe (PID: 3740)

    • Reads the Internet Settings

      • iTopF540-20240322.tmp (PID: 3324)
      • iTopF540-20240322.tmp (PID: 2568)
      • ugin.exe (PID: 4092)
      • Setup.exe (PID: 2484)
      • iTopVPN.exe (PID: 3876)
      • iTopDownloader.exe (PID: 3268)
      • iTopDataRecovery.tmp (PID: 3288)
      • IdrInit.exe (PID: 3940)
      • iTopDataRecovery.exe (PID: 3448)
      • Autoupdate.exe (PID: 2104)
      • atud.exe (PID: 3428)
      • onlinesr_en.exe (PID: 3204)

    • Uses TASKKILL.EXE to kill process

      • iTopF540-20240322.tmp (PID: 2568)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1172)
      • cmd.exe (PID: 668)
      • cmd.exe (PID: 3492)
      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 2372)
      • cmd.exe (PID: 3256)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 3016)
      • cmd.exe (PID: 2828)
      • cmd.exe (PID: 1652)
      • cmd.exe (PID: 1604)
      • cmd.exe (PID: 2556)

    • Process drops SQLite DLL files

      • iTopF540-20240322.tmp (PID: 2568)
      • iTopDataRecovery.tmp (PID: 3288)

    • Starts CMD.EXE for commands execution

      • ugin.exe (PID: 4092)
      • iTopVPN.exe (PID: 3876)
      • iTopDataRecovery.tmp (PID: 3288)

    • Application launched itself

      • ugin.exe (PID: 4092)

    • Non-standard symbols in registry

      • explorer.exe (PID: 1164)
      • iTopVPN.exe (PID: 3876)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 3488)

    • Process requests binary or script from the Internet

      • iTopDownloader.exe (PID: 3268)
      • Autoupdate.exe (PID: 2104)

    • Searches for installed software

      • iTopVPN.exe (PID: 3876)
      • onlinesr_en.exe (PID: 3204)
      • itopeasterp24.exe (PID: 3740)

    • Connects to unusual port

      • iTopVPN.exe (PID: 3876)

    • The process verifies whether the antivirus software is installed

      • iTopVPN.exe (PID: 3876)

    • Executes as Windows Service

      • IDRService.exe (PID: 1168)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)

    • Checks supported languages

      • iTopF540-20240322.exe (PID: 2152)
      • iTopF540-20240322.tmp (PID: 1976)
      • iTopF540-20240322.exe (PID: 1808)
      • iTopF540-20240322.tmp (PID: 3324)
      • ugin.exe (PID: 2724)
      • Setup.exe (PID: 2484)
      • ugin.exe (PID: 952)
      • iTopF540-20240322.tmp (PID: 2568)
      • iTopF540-20240322.exe (PID: 924)
      • ugin.exe (PID: 2656)
      • ullc.exe (PID: 268)
      • ugin.exe (PID: 4092)
      • iTopVPN.exe (PID: 2736)
      • ugin.exe (PID: 3312)
      • unpr.exe (PID: 2980)
      • ugin.exe (PID: 3560)
      • ugin.exe (PID: 3604)
      • icop32.exe (PID: 1428)
      • ugin.exe (PID: 3844)
      • iTopDownloader.exe (PID: 3268)
      • iTopVPN.exe (PID: 3876)
      • iTopVPN.exe (PID: 3868)
      • atud.exe (PID: 3428)
      • aud.exe (PID: 2648)
      • aud.exe (PID: 2124)
      • iTopVPNMini.exe (PID: 3308)
      • iTopDataRecovery.exe (PID: 3816)
      • iTopDataRecovery.tmp (PID: 3288)
      • LocalLang.exe (PID: 1584)
      • iTopInsur.exe (PID: 128)
      • IdrInit.exe (PID: 3940)
      • iTopInsur.exe (PID: 952)
      • UninstallInfo.exe (PID: 920)
      • IDRService.exe (PID: 1168)
      • iTopDataRecovery.exe (PID: 3448)
      • Autoupdate.exe (PID: 2104)
      • ICONPIN32.exe (PID: 3048)
      • AUpdate.exe (PID: 1836)
      • AUpdate.exe (PID: 2396)
      • itopeasterp24.exe (PID: 3740)
      • onlinesr_en.exe (PID: 2804)
      • Newfts.exe (PID: 1220)
      • onlinesr_en.exe (PID: 3204)
      • ugin.exe (PID: 796)
      • itopeasterp24.exe (PID: 4080)

    • Reads the computer name

      • iTopF540-20240322.tmp (PID: 1976)
      • iTopF540-20240322.tmp (PID: 3324)
      • ugin.exe (PID: 2724)
      • Setup.exe (PID: 2484)
      • iTopF540-20240322.tmp (PID: 2568)
      • ugin.exe (PID: 952)
      • iTopVPN.exe (PID: 2736)
      • ugin.exe (PID: 3312)
      • ugin.exe (PID: 2656)
      • ugin.exe (PID: 4092)
      • ugin.exe (PID: 3604)
      • ugin.exe (PID: 3560)
      • unpr.exe (PID: 2980)
      • ugin.exe (PID: 3844)
      • iTopDownloader.exe (PID: 3268)
      • iTopVPN.exe (PID: 3868)
      • iTopVPN.exe (PID: 3876)
      • aud.exe (PID: 2124)
      • atud.exe (PID: 3428)
      • aud.exe (PID: 2648)
      • iTopVPNMini.exe (PID: 3308)
      • iTopDataRecovery.tmp (PID: 3288)
      • iTopInsur.exe (PID: 128)
      • IdrInit.exe (PID: 3940)
      • iTopInsur.exe (PID: 952)
      • UninstallInfo.exe (PID: 920)
      • iTopDataRecovery.exe (PID: 3448)
      • IDRService.exe (PID: 1168)
      • Autoupdate.exe (PID: 2104)
      • AUpdate.exe (PID: 1836)
      • AUpdate.exe (PID: 2396)
      • onlinesr_en.exe (PID: 3204)
      • itopeasterp24.exe (PID: 3740)
      • onlinesr_en.exe (PID: 2804)
      • Newfts.exe (PID: 1220)
      • ugin.exe (PID: 796)
      • itopeasterp24.exe (PID: 4080)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Create files in a temporary directory

      • iTopF540-20240322.exe (PID: 1808)
      • iTopF540-20240322.tmp (PID: 3324)
      • iTopF540-20240322.exe (PID: 2152)
      • Setup.exe (PID: 2484)
      • iTopF540-20240322.exe (PID: 924)
      • iTopF540-20240322.tmp (PID: 2568)
      • icop32.exe (PID: 1428)
      • explorer.exe (PID: 1164)
      • iTopDataRecovery.exe (PID: 3816)
      • iTopDataRecovery.tmp (PID: 3288)
      • SecEdit.exe (PID: 1780)
      • SecEdit.exe (PID: 1928)
      • iTopVPN.exe (PID: 3876)
      • ICONPIN32.exe (PID: 3048)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3276)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2120)

    • Application launched itself

      • iexplore.exe (PID: 2120)

    • Creates files or folders in the user directory

      • ugin.exe (PID: 2724)
      • iTopF540-20240322.tmp (PID: 2568)
      • iTopVPN.exe (PID: 2736)
      • explorer.exe (PID: 1164)
      • iTopVPN.exe (PID: 3876)
      • atud.exe (PID: 3428)
      • iTopVPNMini.exe (PID: 3308)
      • iTopDataRecovery.tmp (PID: 3288)
      • iTopInsur.exe (PID: 128)
      • Autoupdate.exe (PID: 2104)

    • Creates files in the program directory

      • ugin.exe (PID: 2724)
      • iTopF540-20240322.tmp (PID: 2568)
      • Setup.exe (PID: 2484)
      • iTopVPN.exe (PID: 2736)
      • ugin.exe (PID: 4092)
      • ugin.exe (PID: 3844)
      • iTopDownloader.exe (PID: 3268)
      • unpr.exe (PID: 2980)
      • iTopVPN.exe (PID: 3876)
      • atud.exe (PID: 3428)
      • iTopDataRecovery.tmp (PID: 3288)
      • iTopInsur.exe (PID: 128)
      • UninstallInfo.exe (PID: 920)
      • IDRService.exe (PID: 1168)
      • iTopDataRecovery.exe (PID: 3448)
      • Autoupdate.exe (PID: 2104)
      • AUpdate.exe (PID: 1836)
      • onlinesr_en.exe (PID: 3204)

    • Manual execution by a user

      • explorer.exe (PID: 1772)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 2484)
      • ugin.exe (PID: 2724)
      • ugin.exe (PID: 4092)
      • icop32.exe (PID: 1428)
      • unpr.exe (PID: 2980)
      • iTopDownloader.exe (PID: 3268)
      • iTopVPN.exe (PID: 3876)
      • aud.exe (PID: 2124)
      • aud.exe (PID: 2648)
      • atud.exe (PID: 3428)
      • iTopVPNMini.exe (PID: 3308)
      • ICONPIN32.exe (PID: 3048)
      • Autoupdate.exe (PID: 2104)
      • AUpdate.exe (PID: 2396)
      • AUpdate.exe (PID: 1836)
      • onlinesr_en.exe (PID: 3204)
      • ugin.exe (PID: 796)

    • Creates a software uninstall entry

      • iTopF540-20240322.tmp (PID: 2568)
      • iTopDataRecovery.tmp (PID: 3288)

    • Process checks whether UAC notifications are on

      • iTopVPN.exe (PID: 3876)

    • Process checks Internet Explorer phishing filters

      • iTopVPN.exe (PID: 3876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
78
Malicious processes
17
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe itopf540-20240322.exe no specs itopf540-20240322.tmp no specs itopf540-20240322.exe itopf540-20240322.tmp no specs ugin.exe setup.exe explorer.exe no specs itopf540-20240322.exe no specs itopf540-20240322.tmp no specs ugin.exe no specs taskkill.exe no specs ugin.exe no specs ugin.exe no specs ullc.exe itopvpn.exe ugin.exe cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs icop32.exe ugin.exe no specs ugin.exe no specs unpr.exe ugin.exe no specs itopdownloader.exe itopvpn.exe itopvpn.exe atud.exe aud.exe aud.exe cmd.exe no specs ipconfig.exe no specs itopvpnmini.exe itopdatarecovery.exe no specs itopdatarecovery.tmp cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs secedit.exe no specs locallang.exe itopinsur.exe secedit.exe no specs idrinit.exe itopinsur.exe uninstallinfo.exe cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs iconpin32.exe sc.exe no specs idrservice.exe itopdatarecovery.exe autoupdate.exe aupdate.exe aupdate.exe newfts.exe onlinesr_en.exe itopeasterp24.exe onlinesr_en.exe itopeasterp24.exe ugin.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\iTop Data Recovery\iTopInsur.exe" /SetLicenseStatusC:\Program Files\iTop Data Recovery\iTopInsur.exe
iTopDataRecovery.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop Insur
Exit code:
0
Version:
1.0.0.99
Modules
Images
c:\program files\itop data recovery\itopinsur.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
268"C:\Program Files\iTop VPN\ullc.exe" C:\Program Files\iTop VPN\ullc.exe
iTopF540-20240322.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
User Local Language Check
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\itop vpn\ullc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
668cmd.exe /c sc delete windivertC:\Windows\System32\cmd.exe—ugin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
796"C:\Program Files\iTop VPN\ugin.exe" /postbnstC:\Program Files\iTop VPN\ugin.exe
onlinesr_en.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Exit code:
0
Version:
5.0.0.5132
Modules
Images
c:\program files\itop vpn\ugin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
920"C:\Program Files\iTop Data Recovery\UninstallInfo.exe" /install idr4C:\Program Files\iTop Data Recovery\UninstallInfo.exe
iTopDataRecovery.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
UninstallInfo
Exit code:
0
Version:
1.0.0.349
Modules
Images
c:\program files\itop data recovery\uninstallinfo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
924"C:\Users\admin\Downloads\iTopF540-20240322.exe" /sp- /verysilent /norestart /Installer /silenthide /insthandle=1311122 /DIR="C:\Program Files\iTop VPN" /quicklaunchiconC:\Users\admin\Downloads\iTopF540-20240322.exe—Setup.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Exit code:
0
Version:
5.4.0.5166
Modules
Images
c:\users\admin\downloads\itopf540-20240322.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
952"C:\Users\admin\AppData\Local\Temp\is-B5M2V.tmp\ugin.exe" /killC:\Users\admin\AppData\Local\Temp\is-B5M2V.tmp\ugin.exe—iTopF540-20240322.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Exit code:
0
Version:
5.0.0.5132
Modules
Images
c:\users\admin\appdata\local\temp\is-b5m2v.tmp\ugin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
952"C:\Program Files\iTop Data Recovery\iTopInsur.exe" /insur=itopf_in /reinstall=0 /regkeynameinsur="iTop Data Recovery" /writeregWow6432Node=0C:\Program Files\iTop Data Recovery\iTopInsur.exe
IdrInit.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop Insur
Exit code:
0
Version:
1.0.0.99
Modules
Images
c:\program files\itop data recovery\itopinsur.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1168"C:\Program Files\iTop Data Recovery\IDRService.exe"C:\Program Files\iTop Data Recovery\IDRService.exe
services.exe
User:
SYSTEM
Company:
iTop Inc.
Integrity Level:
SYSTEM
Description:
iTop Data Recovery Service
Version:
4.0.0.168
Modules
Images
c:\program files\itop data recovery\idrservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
75 028
Read events
74 257
Write events
715
Delete events
56

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB010000007B491E9E3F828A4F8555DF724FABDA1300000000020000000000106600000001000020000000AB81FAB992C8586DF934AD8D8B9F4BC1A16C73E14E6DC19B39098D43DCB49140000000000E800000000200002000000047F99DF10EEB56343235443ACFCC0293284900C61FAA8AF1206F7BDA4933E374300000000BB41B8A1289B6D5B06FF1470F5FBAE6F078FCBF8C0852728CD7D09E22F7B65CC645BEF3670F6AF58494B32792753DF44000000058369D6CAAD8B8A19FF2D9CB8D13A3B602472ED69E359D34AD8609BD96E67FEF659DCE3139F8F0E6DF31FE0577781AAB885984F01EE8F68C9899F7C17FDB6769
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:Zvpebfbsg.VagreargRkcybere.Qrsnhyg
Value:
000000003F0000004B0000008E0F0D00000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF00FEAE759EB1D60100000000
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000D70100004D0300001B8D9501440000008A0000009B7032007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000070E35D01FFFFFFFF00A92300FFFFFFFF7059E07400000000000000000CE35D017C90DC74000400000000000070E35D01FFFFFFFF00A92300FFFFFFFFA8F82300ACF92300F8A823003CE35D01F7AF8B7580D0BE757CF05D01081D8C75E4618C75E823220070E35D01D08723007000000019BDDC3D50E35D01A1698C75E823220070E35D01000000007CE55D013F618C75E823220070E35D0100000400000000804C618C75E823220063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E0063001100000090522200885222002000700069006E006E00650064005C0088E4000005BADC3D38E45D015E908C7588E45D013CE45D0103948C75000000001C80470264E45D01A9938C751C80470210E55D01907B4702BD938C7500000000907B470210E55D016CE45D01440000008A0000009B7032007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000070E35D01FFFFFFFF00A92300FFFFFFFF7059E07400000000000000000CE35D017C90DC74000400000000000070E35D01FFFFFFFF00A92300FFFFFFFFA8F82300ACF92300F8A823003CE35D01F7AF8B7580D0BE757CF05D01081D8C75E4618C75E823220070E35D01D08723007000000019BDDC3D50E35D01A1698C75E823220070E35D01000000007CE55D013F618C75E823220070E35D0100000400000000804C618C75E823220063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E0063001100000090522200885222002000700069006E006E00650064005C0088E4000005BADC3D38E45D015E908C7588E45D013CE45D0103948C75000000001C80470264E45D01A9938C751C80470210E55D01907B4702BD938C7500000000907B470210E55D016CE45D01440000008A0000009B7032007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000070E35D01FFFFFFFF00A92300FFFFFFFF7059E07400000000000000000CE35D017C90DC74000400000000000070E35D01FFFFFFFF00A92300FFFFFFFFA8F82300ACF92300F8A823003CE35D01F7AF8B7580D0BE757CF05D01081D8C75E4618C75E823220070E35D01D08723007000000019BDDC3D50E35D01A1698C75E823220070E35D01000000007CE55D013F618C75E823220070E35D0100000400000000804C618C75E823220063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E0063001100000090522200885222002000700069006E006E00650064005C0088E4000005BADC3D38E45D015E908C7588E45D013CE45D0103948C75000000001C80470264E45D01A9938C751C80470210E55D01907B4702BD938C7500000000907B470210E55D016CE45D01
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
398284048
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31098537
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
698446548
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31098537
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
280
Suspicious files
38
Text files
366
Unknown types
58

Dropped files

PID
Process
Filename
Type
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\iTopF540-20240322[1].exeexecutable
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF2AEE5AF7D4A00593.TMPbinary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{555E0D95-F29C-11EE-AE0A-12A9866C77DE}.datbinary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\Downloads\iTopF540-20240322.exe.vlj8zqn.partial:Zone.Identifiertext
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\Downloads\iTopF540-20240322.exe —
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA090.tmpxml
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
527
DNS requests
54
Threats
51

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3276
iexplore.exe
GET
200
152.199.23.214:80
http://update.downloaditop.com/dl/action-center/iTopF540-20240322.exe
unknown
—
—
unknown
2120
iexplore.exe
GET
304
92.122.95.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31055eca6ea3b32e
unknown
—
—
unknown
2120
iexplore.exe
GET
304
92.122.95.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?719f0b64dcb4a601
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
—
—
GET
304
92.122.95.146:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f42b4d0af9d9768e
unknown
—
—
unknown
1080
svchost.exe
GET
200
92.122.95.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e2ddf83a2417bb20
unknown
—
—
unknown
1080
svchost.exe
GET
304
92.122.95.25:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fc91d912a85a08d5
unknown
—
—
unknown
2724
ugin.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
unknown
2120
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
2484
Setup.exe
GET
200
34.117.186.192:80
http://ipinfo.io/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3276
iexplore.exe
152.199.23.214:80
update.downloaditop.com
EDGECAST
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2120
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
2120
iexplore.exe
92.122.95.25:80
ctldl.windowsupdate.com
Akamai International B.V.
IT
unknown
2120
iexplore.exe
92.122.95.146:80
ctldl.windowsupdate.com
Akamai International B.V.
IT
unknown
2120
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2724
ugin.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown

DNS requests

Domain
IP
Reputation
update.downloaditop.com
  • 152.199.23.214
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 92.122.95.25
  • 92.122.95.146
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ip-api.com
  • 208.95.112.1
shared
update.itopvpn.com
  • 152.199.23.214
unknown
ipinfo.io
  • 34.117.186.192
shared
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 2.18.97.227
whitelisted

Threats

PID
Process
Class
Message
3276
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
2484
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2484
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2484
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
Process
Message
Setup.exe
time1
Setup.exe
doFinshedEvent_Freeware 0
Setup.exe
time3
Setup.exe
ProductVersion: 5.4.0.5166
Setup.exe
Chk_ver_max
Setup.exe
WinVer 61
Setup.exe
chk_os_ver 110;100;63;62;61
Setup.exe
CheckLicense
Setup.exe
Chk_ver_min
Setup.exe
Order: isr
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://update.downloaditop.com/dl/action-center/iTopF540-20240322.exe