URL:

https://redirector.eset.systems/li-handler/?uuid=epi_win-c2c80013-bfdd-43df-bf56-389ad5e2100e

Full analysis: https://app.any.run/tasks/d8767f1b-6f5c-4537-aaa6-2cf7458f7820
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 18, 2020, 22:38:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

FFA14370C5F8DDCA35F6BA5FB028F99F

SHA1:

32E90D454FAB66D3AF9B1D718474619F373198FA

SHA256:

F16DE3207D269C8FBEAE6AC972AB2C2A4C234ACBEA72F71D86693358125BD6FE

SSDEEP:

3:N8ZxLyR/MB4K1PpLTGFl0hTSFA:2ZNyqH1ceSFA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • epi_win_live_installer.exe (PID: 1708)
      • epi_win_live_installer.exe (PID: 3408)
      • BootHelper.exe (PID: 3960)

    • Loads dropped or rewritten executable

      • epi_win_live_installer.exe (PID: 1708)

    • Downloads executable files from the Internet

      • epi_win_live_installer.exe (PID: 1708)

    • Changes settings of System certificates

      • epi_win_live_installer.exe (PID: 1708)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2352)
      • chrome.exe (PID: 2776)
      • epi_win_live_installer.exe (PID: 3408)
      • epi_win_live_installer.exe (PID: 1708)

    • Adds / modifies Windows certificates

      • epi_win_live_installer.exe (PID: 1708)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2776)
      • chrome.exe (PID: 2352)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2776)
      • chrome.exe (PID: 2352)
      • epi_win_live_installer.exe (PID: 1708)

    • Application launched itself

      • chrome.exe (PID: 2776)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs epi_win_live_installer.exe chrome.exe no specs epi_win_live_installer.exe boothelper.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16539406726829667872 --mojo-platform-channel-handle=1040 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1580"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9613879211122648583 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1708"C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-6697-7C69-973E-01CDED2D46F4}\epi_win_live_installer.exe" --bts-container 3408 "C:\Users\admin\Downloads\epi_win_live_installer.exe" C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-6697-7C69-973E-01CDED2D46F4}\epi_win_live_installer.exe
epi_win_live_installer.exe
User:
admin
Company:
ESET
Integrity Level:
HIGH
Description:
ESET Security
Exit code:
0
Version:
10.7.15.0
Modules
Images
c:\users\admin\appdata\local\temp\eset\bts.session\{02d83bbe-6697-7c69-973e-01cded2d46f4}\epi_win_live_installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
2352"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=8279106082890928612 --mojo-platform-channel-handle=1512 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2364"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5005149220105686860 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2776"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://redirector.eset.systems/li-handler/?uuid=epi_win-c2c80013-bfdd-43df-bf56-389ad5e2100e"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2936"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2780 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3020"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=14277971652573502942 --mojo-platform-channel-handle=1272 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6014267316692616297 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3176"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,18153349228592214548,15140990852412607442,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5284688578311457541 --mojo-platform-channel-handle=504 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 345
Read events
1 257
Write events
85
Delete events
3

Modification events

(PID) Process:(2936) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2776-13239585552671500
Value:
259
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2776) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(2776) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
20
Suspicious files
30
Text files
381
Unknown types
0

Dropped files

PID
Process
Filename
Type
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F137A11-AD8.pma —
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\64e02990-689d-4399-be32-47fa5b41dfb5.tmp —
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF13c2f5.TMPtext
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF13c2e6.TMPtext
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2776chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF13c4f9.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
27
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2776
chrome.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.0 Kb
whitelisted
1708
epi_win_live_installer.exe
GET
200
91.228.166.23:80
http://repository.eset.com:80/v1/com/eset/apps/business/era/agent/metadata3
SK
binary
125 Kb
suspicious
1708
epi_win_live_installer.exe
GET
302
91.228.165.134:80
http://go.eset.eu:80/banner-v2?lng=1033&product=ees&version=7&type=li
SK
html
267 b
suspicious
1708
epi_win_live_installer.exe
GET
301
91.228.167.30:80
http://banner.eset.com:80/banner-v2?product=ees&version=7&type=li&lng=1033
SK
html
292 b
whitelisted
1708
epi_win_live_installer.exe
GET
200
91.228.166.23:80
http://repository.eset.com:80/v1/com/eset/apps/business/ees/windows/metadata3
SK
binary
171 Kb
suspicious
1708
epi_win_live_installer.exe
GET
302
91.228.165.134:80
http://go.eset.eu:80/detectav?product=
SK
html
238 b
suspicious
2776
chrome.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.0 Kb
whitelisted
1708
epi_win_live_installer.exe
GET
404
91.228.167.30:80
http://banner.eset.com:80/banner-v2/?product=ees&version=7&type=li&lng=1033
SK
—
—
whitelisted
1708
epi_win_live_installer.exe
GET
200
91.228.166.82:80
http://download.eset.com:80/com/eset/tools/installers/av_detector/v1/1.91.0.0/detectavdb_windefend.dat
SK
binary
195 Kb
suspicious
1708
epi_win_live_installer.exe
GET
200
91.228.166.82:80
http://download.eset.com:80/special/detectav/detectav.xml
SK
xml
503 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2352
chrome.exe
91.228.167.55:443
redirector.eset.systems
ESET, spol. s r.o.
SK
unknown
2352
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
2352
chrome.exe
91.228.167.110:443
liveinstaller.eset.systems
ESET, spol. s r.o.
SK
suspicious
2352
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2352
chrome.exe
216.58.210.14:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2776
chrome.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1708
epi_win_live_installer.exe
13.91.57.145:443
edf.eset.com
Microsoft Corporation
US
unknown
1708
epi_win_live_installer.exe
91.228.166.23:80
repository.eset.com
ESET, spol. s r.o.
SK
suspicious
1708
epi_win_live_installer.exe
91.228.165.134:80
go.eset.eu
ESET, spol. s r.o.
SK
unknown
1708
epi_win_live_installer.exe
91.228.166.82:80
download.eset.com
ESET, spol. s r.o.
SK
suspicious

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
redirector.eset.systems
  • 91.228.167.55
unknown
accounts.google.com
  • 172.217.16.141
shared
liveinstaller.eset.systems
  • 91.228.167.110
suspicious
www.google.com
  • 216.58.208.36
malicious
sb-ssl.google.com
  • 216.58.210.14
whitelisted
ssl.gstatic.com
  • 172.217.16.163
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
edf.eset.com
  • 13.91.57.145
unknown
repository.eset.com
  • 91.228.166.23
malicious

Threats

PID
Process
Class
Message
1708
epi_win_live_installer.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://redirector.eset.systems/li-handler/?uuid=epi_win-c2c80013-bfdd-43df-bf56-389ad5e2100e