We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
30 December 2019, 17:39
Analysis environment:
Windows 7 Pro, build 7601, x86
http://jdownloader.org/download/index?s=lng_en
MD5:
29C97BF3D7506F59C4657F2F860A498D
SHA1:
41FBEAC4038303C7C9EB78A7AB16656AA0C0AE8B
SHA256:
E145151C7C677ADD958308E0223CACFDF92F68EDF00A94716E221C0FC6B3B3D3
Analysis result
Threat level:
Malicious activity
Tags:
adware
pua
lavasoft
Full analysis:
Analysis http://jdownloader.org/download/index?s=lng_en Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Application was dropped or rewritten from another process
JDownloaderSetup.exe (PID: 1812)
GenericSetup.exe (PID: 3016)
JDownloaderSetup.exe (PID: 1888)
installer.exe (PID: 3764)
unpack200.exe (PID: 2412)
unpack200.exe (PID: 3264)
unpack200.exe (PID: 3196)
unpack200.exe (PID: 3816)
unpack200.exe (PID: 3976)
unpack200.exe (PID: 3776)
unpack200.exe (PID: 1896)
unpack200.exe (PID: 3004)
unpack200.exe (PID: 1752)
unpack200.exe (PID: 2076)
unpack200.exe (PID: 3768)
unpack200.exe (PID: 2800)
unpack200.exe (PID: 1940)
unpack200.exe (PID: 2892)
unpack200.exe (PID: 2432)
unpack200.exe (PID: 2340)
unpack200.exe (PID: 3308)
unpack200.exe (PID: 3268)
java.exe (PID: 2476)
javaw.exe (PID: 4012)
java.exe (PID: 1556)
JDownloader2.exe (PID: 1560)
Loads dropped or rewritten executable
GenericSetup.exe (PID: 3016)
Carrier.exe (PID: 2160)
unpack200.exe (PID: 2800)
unpack200.exe (PID: 2412)
unpack200.exe (PID: 1560)
unpack200.exe (PID: 3816)
unpack200.exe (PID: 3268)
unpack200.exe (PID: 3308)
unpack200.exe (PID: 2892)
unpack200.exe (PID: 3776)
unpack200.exe (PID: 3264)
unpack200.exe (PID: 3196)
unpack200.exe (PID: 3004)
unpack200.exe (PID: 2076)
unpack200.exe (PID: 3380)
unpack200.exe (PID: 1940)
unpack200.exe (PID: 2340)
unpack200.exe (PID: 1752)
unpack200.exe (PID: 1896)
unpack200.exe (PID: 3976)
java.exe (PID: 2476)
unpack200.exe (PID: 688)
unpack200.exe (PID: 2432)
unpack200.exe (PID: 3768)
javaw.exe (PID: 4012)
JDownloader2.exe (PID: 1560)
java.exe (PID: 1556)
LAVASOFT was detected
installer.exe (PID: 3764)
SUSPICIOUS
Modifies files in Chrome extension folder
chrome.exe (PID: 2504)
Executable content was dropped or overwritten
chrome.exe (PID: 2504)
JDownloaderSetup.exe (PID: 1888)
Carrier.exe (PID: 2160)
JDownloader2.exe (PID: 1560)
Reads Environment values
GenericSetup.exe (PID: 3016)
Reads the Windows organization settings
GenericSetup.exe (PID: 3016)
Reads Windows owner or organization settings
GenericSetup.exe (PID: 3016)
Starts CMD.EXE for commands execution
GenericSetup.exe (PID: 3016)
Creates files in the user directory
Carrier.exe (PID: 2160)
Creates files in the program directory
Carrier.exe (PID: 2160)
java.exe (PID: 2476)
java.exe (PID: 1556)
Uses REG.EXE to modify Windows registry
Carrier.exe (PID: 2160)
JDownloader2.exe (PID: 1560)
Uses ICACLS.EXE to modify access control list
java.exe (PID: 2476)
Application launched itself
Carrier.exe (PID: 2160)
Creates a software uninstall entry
Carrier.exe (PID: 2160)
Modifies the open verb of a shell class
Carrier.exe (PID: 2160)
Searches for installed software
Carrier.exe (PID: 2160)
GenericSetup.exe (PID: 3016)
INFO
Reads the hosts file
chrome.exe (PID: 1848)
chrome.exe (PID: 2504)
Application launched itself
chrome.exe (PID: 2504)
Reads Internet Cache Settings
chrome.exe (PID: 2504)
Reads settings of System Certificates
GenericSetup.exe (PID: 3016)
Dropped object may contain Bitcoin addresses
Carrier.exe (PID: 2160)
Threats
PID
Process
Class
Message
3764
installer.exe
A Network Trojan was detected
ET MALWARE Lavasoft PUA/Adware Client Install