download:

/ISetup5.exe

Full analysis: https://app.any.run/tasks/56fccd7b-a049-4639-a132-db3bc23cf90d
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: April 15, 2024, 10:47:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
gcleaner
loader
stealer
stealc
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

367655671A22A537CA614704F4B506C8

SHA1:

B219FB346CA645501F9A0F202C928A781DC55462

SHA256:

E4A4187057882D04B22D5FA1007DCEB599388F15547889965E888294C4DEAB85

SSDEEP:

12288:1xHPcXIacLpco6svFKqdu/d3iMqkez3F1MkfJHhdxVVVVVE4:L6u1FKq6d3iMqkW3FOYJhd44

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ISetup5.exe (PID: 2648)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • GCLEANER has been detected (SURICATA)

      • ISetup5.exe (PID: 2648)

    • STEALC has been detected (SURICATA)

      • u21k.0.exe (PID: 4044)

    • Connects to the CnC server

      • u21k.0.exe (PID: 4044)

    • Creates a writable file in the system directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Steals credentials from Web Browsers

      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • iolo.exe (PID: 1928)

    • Actions looks like stealing of personal data

      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 3984)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iolo.exe (PID: 324)

  • SUSPICIOUS

    • Reads the Internet Settings

      • ISetup5.exe (PID: 2648)
      • u21k.0.exe (PID: 4044)
      • u21k.1.exe (PID: 848)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Reads security settings of Internet Explorer

      • ISetup5.exe (PID: 2648)
      • u21k.0.exe (PID: 4044)
      • u21k.1.exe (PID: 848)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Windows Defender mutex has been found

      • u21k.0.exe (PID: 4044)

    • Executable content was dropped or overwritten

      • ISetup5.exe (PID: 2648)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Reads the date of Windows installation

      • u21k.1.exe (PID: 848)
      • incinerator.exe (PID: 3292)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 3984)

    • Connects to the server without a host name

      • ISetup5.exe (PID: 2648)

    • Process requests binary or script from the Internet

      • ISetup5.exe (PID: 2648)

    • Searches for installed software

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Reads settings of System Certificates

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Process drops legitimate windows executable

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Creates or modifies Windows services

      • nfregdrv.exe (PID: 1628)

    • Drops a system driver (possible attempt to evade defenses)

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Creates a software uninstall entry

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Creates files in the driver directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Process drops SQLite DLL files

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)

    • Reads Microsoft Outlook installation path

      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Changes Internet Explorer settings (feature browser emulation)

      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Reads Internet Explorer settings

      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3600)

  • INFO

    • Checks supported languages

      • ISetup5.exe (PID: 2648)
      • u21k.0.exe (PID: 4044)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • nfregdrv.exe (PID: 1628)
      • incinerator.exe (PID: 3292)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • u21k.1.exe (PID: 848)
      • ioloTrayApp.exe (PID: 3984)
      • ioloTrayApp.exe (PID: 1168)

    • Reads the computer name

      • ISetup5.exe (PID: 2648)
      • u21k.0.exe (PID: 4044)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • nfregdrv.exe (PID: 1628)
      • incinerator.exe (PID: 3292)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • u21k.1.exe (PID: 848)
      • ioloTrayApp.exe (PID: 3984)
      • ioloTrayApp.exe (PID: 1168)

    • Create files in a temporary directory

      • ISetup5.exe (PID: 2648)
      • u21k.1.exe (PID: 848)

    • Checks proxy server information

      • u21k.0.exe (PID: 4044)
      • u21k.1.exe (PID: 848)
      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Reads the machine GUID from the registry

      • u21k.0.exe (PID: 4044)
      • u21k.1.exe (PID: 848)
      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 3984)
      • ioloTrayApp.exe (PID: 1168)

    • Creates files in the program directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • u21k.1.exe (PID: 848)
      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Creates files or folders in the user directory

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • regsvr32.exe (PID: 3600)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 1168)
      • ioloTrayApp.exe (PID: 3984)

    • Reads Environment values

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • incinerator.exe (PID: 3292)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 3984)
      • ioloTrayApp.exe (PID: 1168)

    • Reads product name

      • incinerator.exe (PID: 3292)
      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 3984)

    • Reads the software policy settings

      • SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 2096)
      • iolo.exe (PID: 324)
      • iolo.exe (PID: 1928)

    • Application launched itself

      • msedge.exe (PID: 3000)
      • msedge.exe (PID: 2044)

    • Manual execution by a user

      • msedge.exe (PID: 2044)
      • iolo.exe (PID: 1928)
      • iolo.exe (PID: 4020)

    • Reads the time zone

      • iolo.exe (PID: 324)
      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • iolo.exe (PID: 1928)
      • ioloTrayApp.exe (PID: 3984)

    • Reads Microsoft Office registry keys

      • ioloTrayApp.exe (PID: 1232)
      • ioloTrayApp.exe (PID: 2452)
      • ioloTrayApp.exe (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (72.3)
.exe | Win32 Executable (generic) (11.8)
.exe | Clipper DOS Executable (5.2)
.exe | Generic Win/DOS Executable (5.2)
.exe | DOS Executable Generic (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:21 02:50:09+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 108544
InitializedDataSize: 43203072
UninitializedDataSize: -
EntryPoint: 0x68f2
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 42.0.0.0
ProductVersionNumber: 83.0.0.0
FileFlagsMask: 0x950a
FileFlags: (none)
FileOS: Unknown (0x20823)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Unknown (0479)
CharacterSet: Unknown (24E2)
InternalName: Hole
FileDescription: Bill
OriginalFileName: Fires
ProductName: Selfie
ProductVersions: 46.10.50.17
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
40
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #GCLEANER isetup5.exe #STEALC u21k.0.exe u21k.1.exe systemmechanic_5488cb36-be62-4606-b07b-2ee938868bd1.exe no specs systemmechanic_5488cb36-be62-4606-b07b-2ee938868bd1.exe nfregdrv.exe no specs incinerator.exe no specs netsh.exe no specs msedge.exe no specs msedge.exe no specs iolo.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs iolotrayapp.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs regsvr32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs iolotrayapp.exe iolo.exe no specs iolo.exe iolotrayapp.exe iolotrayapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Program Files\iolo technologies\System Mechanic\iolo.exe"C:\Program Files\iolo technologies\System Mechanic\iolo.exe
SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
System Mechanic
Exit code:
4
Version:
24.3.0.57
Modules
Images
c:\program files\iolo technologies\system mechanic\iolo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
784"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4212 --field-trial-handle=1152,i,13237446477805427599,8312076922104909723,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
848"C:\Users\admin\AppData\Local\Temp\u21k.1.exe" C:\Users\admin\AppData\Local\Temp\u21k.1.exe
ISetup5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\u21k.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1168"C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe" C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe
iolo.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
ioloTrayApp
Exit code:
0
Version:
24.3.0.57
Modules
Images
c:\program files\iolo technologies\system mechanic\iolotrayapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1232"C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe" C:\Program Files\iolo technologies\System Mechanic\ioloTrayApp.exe
iolo.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
ioloTrayApp
Exit code:
0
Version:
24.3.0.57
Modules
Images
c:\program files\iolo technologies\system mechanic\iolotrayapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1340"C:\Users\admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1C:\Users\admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe—u21k.1.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
MEDIUM
Description:
System Mechanic
Exit code:
3221226540
Version:
24.3.0.57
Modules
Images
c:\users\admin\appdata\local\temp\iolo\dm\systemmechanic_5488cb36-be62-4606-b07b-2ee938868bd1.exe
c:\windows\system32\ntdll.dll
1384"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1424 --field-trial-handle=1152,i,13237446477805427599,8312076922104909723,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1628"C:\Program Files\iolo technologies\System Mechanic\WPF_Driver\release\win32\nfregdrv.exe" pgfilterC:\Program Files\iolo technologies\System Mechanic\WPF_Driver\release\win32\nfregdrv.exe—SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\iolo technologies\system mechanic\wpf_driver\release\win32\nfregdrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iolo technologies\system mechanic\wpf_driver\release\win32\nfapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
1864"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3548 --field-trial-handle=1152,i,13237446477805427599,8312076922104909723,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1928"C:\Program Files\iolo technologies\System Mechanic\iolo.exe" C:\Program Files\iolo technologies\System Mechanic\iolo.exe
explorer.exe
User:
admin
Company:
RealDefense LLC
Integrity Level:
HIGH
Description:
System Mechanic
Exit code:
4
Version:
24.3.0.57
Modules
Images
c:\program files\iolo technologies\system mechanic\iolo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
48 292
Read events
47 839
Write events
433
Delete events
20

Modification events

(PID) Process:(2648) ISetup5.exeKey:HKEY_CURRENT_USER\Software\BroomCleaner
Operation:writeName:Installed
Value:
1
(PID) Process:(2648) ISetup5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2648) ISetup5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2648) ISetup5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2648) ISetup5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4044) u21k.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4044) u21k.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4044) u21k.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4044) u21k.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4044) u21k.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
Executable files
113
Suspicious files
100
Text files
99
Unknown types
61

Dropped files

PID
Process
Filename
Type
2648ISetup5.exeC:\Users\admin\AppData\Local\Temp\u21k.0.exeexecutable
MD5:—
SHA256:—
2648ISetup5.exeC:\Users\admin\AppData\Local\Temp\u21k.1.exeexecutable
MD5:—
SHA256:—
848u21k.1.exeC:\Users\admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txttext
MD5:—
SHA256:—
848u21k.1.exeC:\ProgramData\iolo\logs\WSComm.logtext
MD5:—
SHA256:—
2096SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\ProgramData\iolo technologies\logs\bootstrap.logtext
MD5:—
SHA256:—
2096SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Users\admin\AppData\Local\Microsoft\ApplicationInsights\47dcca04762a106e6b55dd88274558025456a143c2b1d8c4b4388b40b1f29722\2gsnt225.4ecbinary
MD5:—
SHA256:—
2096SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\ACResources.dllexecutable
MD5:—
SHA256:—
2096SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\gpp.exeexecutable
MD5:—
SHA256:—
2096SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\defrag.dllexecutable
MD5:—
SHA256:—
2096SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeC:\Program Files\iolo technologies\System Mechanic\Incinerator.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
111
DNS requests
119
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2648
ISetup5.exe
GET
200
185.172.128.228:80
http://185.172.128.228/ping.php?substr=five
unknown
—
—
unknown
2648
ISetup5.exe
GET
200
185.172.128.90:80
http://185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
unknown
—
—
unknown
4044
u21k.0.exe
POST
200
185.172.128.209:80
http://185.172.128.209/3cd2b41cbde8fc9c.php
unknown
—
—
unknown
2648
ISetup5.exe
GET
200
185.172.128.59:80
http://185.172.128.59/syncUpd.exe
unknown
—
—
unknown
856
svchost.exe
HEAD
200
169.150.247.34:80
http://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
unknown
—
—
unknown
856
svchost.exe
GET
200
169.150.247.34:80
http://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
unknown
—
—
unknown
324
iolo.exe
HEAD
200
185.59.220.198:80
http://download.iolo.net/sm/profiles/default/profiles.dat
unknown
—
—
unknown
2648
ISetup5.exe
GET
200
185.172.128.228:80
http://185.172.128.228/BroomSetup.exe
unknown
—
—
unknown
324
iolo.exe
HEAD
200
185.59.220.198:80
http://download.iolo.net/sm/supertuds/default/tud.dat
unknown
—
—
unknown
848
u21k.1.exe
POST
200
20.157.87.45:80
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2648
ISetup5.exe
185.172.128.90:80
—
OOO Nadym Svyaz Service
RU
malicious
2648
ISetup5.exe
185.172.128.228:80
—
OOO Nadym Svyaz Service
RU
unknown
2648
ISetup5.exe
185.172.128.59:80
—
OOO Nadym Svyaz Service
RU
unknown
4044
u21k.0.exe
185.172.128.209:80
—
OOO Nadym Svyaz Service
RU
malicious
848
u21k.1.exe
20.157.87.45:80
svc.iolo.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1888
svchost.exe
239.255.255.250:1900
—
—
—
unknown
856
svchost.exe
169.150.247.34:80
download.iolo.net
—
GB
unknown

DNS requests

Domain
IP
Reputation
svc.iolo.com
  • 20.157.87.45
unknown
download.iolo.net
  • 169.150.247.34
  • 185.59.220.198
whitelisted
westus2-2.in.applicationinsights.azure.com
  • 20.9.155.150
unknown
iolo.azure-api.net
  • 20.190.22.230
unknown
www.iolo.com
  • 52.31.93.31
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
assets.iolo.com
  • 169.150.247.38
unknown
fonts.googleapis.com
  • 142.250.186.170
whitelisted
fonts.gstatic.com
  • 216.58.212.163
whitelisted

Threats

PID
Process
Class
Message
2648
ISetup5.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
2648
ISetup5.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner URI Pattern M2
2648
ISetup5.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
2648
ISetup5.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
2648
ISetup5.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2648
ISetup5.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2648
ISetup5.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2648
ISetup5.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2648
ISetup5.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2648
ISetup5.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4 ETPRO signatures available at the full report
Process
Message
u21k.1.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
u21k.1.exe
-> No proxy. Direct connection
u21k.1.exe
HandleCommunicationFailure : Service Communication failed (attempt # 1 of 3).
u21k.1.exe
PeformServiceCommunication : Error in Class EIdSocketError. Socket Error # 10060 Connection timed out..
u21k.1.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
u21k.1.exe
HandleCommunicationFailure : CanRetry = True.
u21k.1.exe
-> No proxy. Direct connection
u21k.1.exe
IsValidCommunication : Result := True.
u21k.1.exe
-> No proxy. Direct connection
u21k.1.exe
PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/ISetup5.exe