File name:

repairit_setup_full5913.exe

Full analysis: https://app.any.run/tasks/e8dfcb7c-f17e-4749-b5b0-b6690aa665f1
Verdict: Malicious activity
Analysis date: September 02, 2024, 10:27:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

82CC506825A4848AE5D590EBDAA14BCA

SHA1:

F922D994548B698D3C99EBE6221B7AA730537AAF

SHA256:

FE18AB75CA97E7D5F8989CE592A9E0F85B192ECAFDF4937BE4FE8537BF1A5655

SSDEEP:

98304:fJFfX3z+2Pwwgpzp5suNP4Uv5+/wDMXC7zKmfWOj:IF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • repairit_setup_full5913.exe (PID: 6988)

    • Registers / Runs the DLL via REGSVR32.EXE

      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • repairit_setup_full5913.exe (PID: 6988)

    • Reads security settings of Internet Explorer

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.tmp (PID: 5944)
      • repairit.exe (PID: 644)
      • repairit.exe (PID: 6432)
      • cbscustomizedclient_repairit.exe (PID: 8)

    • Reads Internet Explorer settings

      • repairit_setup_full5913.exe (PID: 6988)

    • Executable content was dropped or overwritten

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.exe (PID: 6000)
      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)
      • LAVFilters-0.74.1-Installer.exe (PID: 5400)

    • Drops the executable file immediately after the start

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.tmp (PID: 5944)
      • repairit_full5913.exe (PID: 6000)
      • LAVFilters-0.74.1-Installer.exe (PID: 5400)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)

    • Likely accesses (executes) a file from the Public directory

      • NFWCHK.exe (PID: 4668)
      • repairit_full5913.exe (PID: 6000)
      • repairit_full5913.tmp (PID: 5944)

    • Checks Windows Trust Settings

      • repairit_setup_full5913.exe (PID: 6988)

    • Connects to unusual port

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit.exe (PID: 644)

    • Potential Corporate Privacy Violation

      • repairit_setup_full5913.exe (PID: 6988)

    • Reads the Windows owner or organization settings

      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)

    • Reads the date of Windows installation

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)

    • Process requests binary or script from the Internet

      • repairit_setup_full5913.exe (PID: 6988)

    • Process drops python dynamic module

      • repairit_full5913.tmp (PID: 5944)

    • The process drops C-runtime libraries

      • repairit_full5913.tmp (PID: 5944)

    • Process drops SQLite DLL files

      • repairit_full5913.tmp (PID: 5944)

    • Drops 7-zip archiver for unpacking

      • repairit_full5913.tmp (PID: 5944)

    • Process drops legitimate windows executable

      • repairit_full5913.tmp (PID: 5944)

    • Reads the BIOS version

      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 4760)
      • regsvr32.exe (PID: 1932)
      • regsvr32.exe (PID: 2456)
      • regsvr32.exe (PID: 6132)
      • regsvr32.exe (PID: 6768)
      • regsvr32.exe (PID: 6332)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 5740)

    • Searches for installed software

      • repairit.exe (PID: 644)

  • INFO

    • Reads the machine GUID from the registry

      • repairit_setup_full5913.exe (PID: 6988)
      • NFWCHK.exe (PID: 4668)
      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)
      • messagepush_repairit.exe (PID: 4436)

    • Checks supported languages

      • repairit_setup_full5913.exe (PID: 6988)
      • NFWCHK.exe (PID: 4668)
      • repairit_full5913.exe (PID: 6000)
      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)
      • LAVFilters-0.74.1-Installer.exe (PID: 5400)
      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)
      • RepairitDBFeedBack.exe (PID: 1288)
      • cbscustomizedclient_repairit.exe (PID: 8)
      • messagepush_repairit.exe (PID: 4436)
      • autoupgrade.exe (PID: 4524)

    • Create files in a temporary directory

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.exe (PID: 6000)
      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)
      • LAVFilters-0.74.1-Installer.exe (PID: 5400)
      • repairit.exe (PID: 644)

    • Reads the computer name

      • repairit_setup_full5913.exe (PID: 6988)
      • NFWCHK.exe (PID: 4668)
      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)
      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)
      • cbscustomizedclient_repairit.exe (PID: 8)
      • messagepush_repairit.exe (PID: 4436)
      • autoupgrade.exe (PID: 4524)

    • Checks proxy server information

      • repairit_setup_full5913.exe (PID: 6988)
      • slui.exe (PID: 5548)

    • Reads the software policy settings

      • repairit_setup_full5913.exe (PID: 6988)
      • slui.exe (PID: 6344)
      • slui.exe (PID: 5548)
      • repairit_full5913.tmp (PID: 5944)

    • Process checks Internet Explorer phishing filters

      • repairit_setup_full5913.exe (PID: 6988)

    • Creates files in the program directory

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)
      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)
      • RepairitDBFeedBack.exe (PID: 1288)
      • autoupgrade.exe (PID: 4524)
      • messagepush_repairit.exe (PID: 4436)

    • The process uses the downloaded file

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.tmp (PID: 5944)
      • explorer.exe (PID: 3296)
      • repairit.exe (PID: 644)
      • repairit.exe (PID: 6432)

    • Process checks computer location settings

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit.exe (PID: 6432)
      • repairit.exe (PID: 644)

    • Creates files or folders in the user directory

      • repairit_setup_full5913.exe (PID: 6988)
      • repairit_full5913.tmp (PID: 5944)

    • Dropped object may contain TOR URL's

      • repairit_full5913.tmp (PID: 5944)

    • Creates a software uninstall entry

      • repairit_full5913.tmp (PID: 5944)
      • LAVFilters-0.74.1-Installer.tmp (PID: 6112)

    • Process checks whether UAC notifications are on

      • repairit.exe (PID: 6432)

    • Application launched itself

      • chrome.exe (PID: 6844)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 6844)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 3296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:13 08:19:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 700928
UninitializedDataSize: -
EntryPoint: 0x1069f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.18
ProductVersionNumber: 4.0.4.18
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: wondershare-repairit_setup_full5913.exe
FileVersion: 4.0.4.18
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: Wondershare Repairit
ProductVersion: 5.1.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
41
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start repairit_setup_full5913.exe svchost.exe nfwchk.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe repairit_full5913.exe repairit_full5913.tmp lavfilters-0.74.1-installer.exe lavfilters-0.74.1-installer.tmp regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs repairit.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs chrome.exe no specs explorer.exe no specs repairit.exe chrome.exe no specs repairitdbfeedback.exe no specs conhost.exe no specs cbscustomizedclient_repairit.exe no specs conhost.exe no specs messagepush_repairit.exe autoupgrade.exe conhost.exe no specs repairit_setup_full5913.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8"C:\Program Files\Wondershare\Wondershare Repairit\cbscustomizedclient_repairit.exe" /FilePath "C:\ProgramData/Wondershare/Repairit/Customization.xml" /Language "ENG"C:\Program Files\Wondershare\Wondershare Repairit\cbscustomizedclient_repairit.exe—repairit.exe
User:
admin
Integrity Level:
MEDIUM
Description:
cbscustomizedclient
Exit code:
0
Version:
1.2.0.3
Modules
Images
c:\program files\wondershare\wondershare repairit\cbscustomizedclient_repairit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
644"C:\Program Files\Wondershare\Wondershare Repairit\repairit.exe" C:\Program Files\Wondershare\Wondershare Repairit\repairit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Wondershare Repairit
Version:
6.0.0.40
Modules
Images
c:\program files\wondershare\wondershare repairit\repairit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\crypt32.dll
752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—RepairitDBFeedBack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1060C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1288"C:\Program Files\Wondershare\Wondershare Repairit\RepairitDBFeedBack.exe" C:\Program Files\Wondershare\Wondershare Repairit\RepairitDBFeedBack.exe—repairit.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\wondershare\wondershare repairit\repairitdbfeedback.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\wondershare\wondershare repairit\qt5core.dll
c:\program files\wondershare\wondershare repairit\vcruntime140.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
1496"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4596 --field-trial-handle=1972,i,2901693264262186669,16006982974905788889,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1932"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\LAV Filters\x86\LAVSplitter.ax"C:\Windows\SysWOW64\regsvr32.exe—LAVFilters-0.74.1-Installer.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2456"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\LAV Filters\x86\LAVAudio.ax"C:\Windows\SysWOW64\regsvr32.exe—LAVFilters-0.74.1-Installer.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2580"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1972,i,2901693264262186669,16006982974905788889,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
19 266
Read events
18 730
Write events
522
Delete events
14

Modification events

(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WafCX
Operation:writeName:5913
Value:
sku-ween
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{4b9f6448-9b03-4fe9-b87d-7dc33d4a255fG}
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{4b9f6448-9b03-4fe9-b87d-7dc33d4a255fG}
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6988) repairit_setup_full5913.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
533
Suspicious files
192
Text files
310
Unknown types
11

Dropped files

PID
Process
Filename
Type
6988repairit_setup_full5913.exeC:\Users\Public\Documents\Wondershare\repairit_full5913.exe.~P2S —
MD5:—
SHA256:—
6988repairit_setup_full5913.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\NotoSansSC-Regular[1].otf —
MD5:—
SHA256:—
6988repairit_setup_full5913.exeC:\Users\Public\Documents\Wondershare\repairit_full5913.exe —
MD5:—
SHA256:—
6988repairit_setup_full5913.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Banner2[1].pngimage
MD5:BFFCC5E2B11E9740D9AFCA059E898A98
SHA256:90118F6DD255F41DD1FCD870491D8E4A94B0EE81B30861BF19224AF82A9C235F
6988repairit_setup_full5913.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\Banner4[1].pngimage
MD5:EE0D27A2E099B34D6AF80E1F39D056AF
SHA256:AB0FE49B9D6FDF03FB1FA93F64D752025FEC28BDFA502D111A3EA1FB2CE86658
6988repairit_setup_full5913.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe.configxml
MD5:5BABF2A106C883A8E216F768DB99AD51
SHA256:9E676A617EB0D0535AC05A67C0AE0C0E12D4E998AB55AC786A031BFC25E28300
6988repairit_setup_full5913.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\jquery-2_1_4.min[1].jstext
MD5:5A78469E930137026167FC0FBA0FE3E6
SHA256:7BB14685F20EF4995672F51029F6BE814F866A035D7869F7DA6756A5FE8AC649
6988repairit_setup_full5913.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\javascript_call_native[1].jstext
MD5:B9DA127236EFDB755F568304B5EF3044
SHA256:01C839C0A9C47DC571175312EBC208EAE6FF28CED3A3EFA13C1EE81CD9764F71
6000repairit_full5913.exeC:\Users\admin\AppData\Local\Temp\is-MEQMM.tmp\repairit_full5913.tmpexecutable
MD5:E18E2CFD9573710EE7EA84341396CD17
SHA256:BCFA1343B6BD0176785ECACFEDA0C2EEFD2C391D0F7C21A9C465FDB9F5143F63
6988repairit_setup_full5913.exeC:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_5913.xmlxml
MD5:C15E9FD55D1ABC9C58726BCF1510494E
SHA256:4805296C89D1249BE3478986F2E8829545D373C97ADE9CA7C1BDCB48540DE140
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
165
DNS requests
136
Threats
24

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6988
repairit_setup_full5913.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={4b9f6448-9b03-4fe9-b87d-7dc33d4a255fG}&product_id=5913&wae=4.0.4&platform=win_x64
unknown
—
—
whitelisted
6988
repairit_setup_full5913.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
—
—
whitelisted
6988
repairit_setup_full5913.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
—
—
whitelisted
6988
repairit_setup_full5913.exe
HEAD
200
80.67.82.80:80
http://download.wondershare.com/cbs_down/repairit_full5913.exe
unknown
—
—
whitelisted
6988
repairit_setup_full5913.exe
HEAD
200
80.67.82.80:80
http://download.wondershare.com/cbs_down/repairit_full5913.exe
unknown
—
—
whitelisted
6988
repairit_setup_full5913.exe
HEAD
200
80.67.82.88:80
http://download.wondershare.com/cbs_down/repairit_full5913.exe
unknown
—
—
whitelisted
1752
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5944
repairit_full5913.tmp
GET
302
8.209.73.211:80
http://cbs.wondershare.com/go.php?pid=5913&m=i&product_version=6.0.0&client_sign=%7B%7BEB7F6527-33E8-47C1-9724-3DDB6BA0F7A3%7D%7D&is_silent_install=1&cbs_redirect=1
unknown
—
—
whitelisted
6988
repairit_setup_full5913.exe
GET
—
80.67.82.80:80
http://download.wondershare.com/cbs_down/repairit_full5913.exe
unknown
—
—
whitelisted
5180
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3832
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6052
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6988
repairit_setup_full5913.exe
8.209.72.213:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
malicious
6988
repairit_setup_full5913.exe
8.209.73.211:80
platform.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
whitelisted
6988
repairit_setup_full5913.exe
47.91.89.51:443
prod-web.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
malicious
6988
repairit_setup_full5913.exe
80.67.82.80:80
download.wondershare.com
Akamai International B.V.
CH
whitelisted
6988
repairit_setup_full5913.exe
47.91.90.244:8106
analytics.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
malicious
6052
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
pc-api.wondershare.cc
  • 8.209.72.213
malicious
platform.wondershare.cc
  • 8.209.73.211
malicious
prod-web.wondershare.cc
  • 47.91.89.51
malicious
download.wondershare.com
  • 80.67.82.80
  • 80.67.82.88
whitelisted
analytics.wondershare.cc
  • 47.91.90.244
malicious
settings-win.data.microsoft.com
  • 20.73.194.208
  • 52.191.219.104
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.68
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6988
repairit_setup_full5913.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6988
repairit_setup_full5913.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
4 ETPRO signatures available at the full report
Process
Message
repairit.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
repairit.exe
start work net list
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
repairit_setup_full5913.exe