File name:

KeePass-2.56-Setup.exe

Full analysis: https://app.any.run/tasks/c9cfd1e5-e507-4f45-9105-cf2e4f5245b7
Verdict: Malicious activity
Analysis date: May 20, 2025, 09:02:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

8B386B89E614D3084C1DA3C28E324FB2

SHA1:

D2984F9BF8F71CBBED61E44CD4F1E888A8F2A26A

SHA256:

0000CFF6A3C7F7EEBC0EDC3D1E42E454EBB675E57D6FC1FD968952694B1B44B3

SSDEEP:

98304:X6Gavikf8V1TtLDPaCeU1b4JYUr5gg3DqdeKWa4SvVvsThGuoQtEyJg7kXhsTMF0:F8GMOaLKGMpUnUoLduP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KeePass-2.56-Setup.exe (PID: 7200)
      • KeePass.exe (PID: 7972)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • KeePass-2.56-Setup.exe (PID: 7200)
      • KeePass-2.56-Setup.tmp (PID: 7220)

    • Reads the Windows owner or organization settings

      • KeePass-2.56-Setup.tmp (PID: 7220)

  • INFO

    • Compiled with Borland Delphi (YARA)

      • KeePass-2.56-Setup.exe (PID: 7200)
      • KeePass-2.56-Setup.tmp (PID: 7220)

    • Detects InnoSetup installer (YARA)

      • KeePass-2.56-Setup.exe (PID: 7200)
      • KeePass-2.56-Setup.tmp (PID: 7220)

    • Reads the computer name

      • KeePass-2.56-Setup.tmp (PID: 7220)

    • Checks supported languages

      • KeePass-2.56-Setup.tmp (PID: 7220)
      • KeePass-2.56-Setup.exe (PID: 7200)

    • Creates files or folders in the user directory

      • KeePass-2.56-Setup.tmp (PID: 7220)

    • Create files in a temporary directory

      • KeePass-2.56-Setup.tmp (PID: 7220)
      • KeePass-2.56-Setup.exe (PID: 7200)

    • The sample compiled with german language support

      • KeePass-2.56-Setup.tmp (PID: 7220)

    • The sample compiled with english language support

      • KeePass-2.56-Setup.tmp (PID: 7220)

    • Creates a software uninstall entry

      • KeePass-2.56-Setup.tmp (PID: 7220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:12 05:53:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 684032
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa7f98
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Dominik Reichl
FileDescription: KeePass Password Safe 2 Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: KeePass Password Safe 2
ProductVersion: 2.56.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start keepass-2.56-setup.exe keepass-2.56-setup.tmp sppextcomobj.exe no specs slui.exe keepass.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7200"C:\Users\admin\AppData\Local\Temp\KeePass-2.56-Setup.exe" C:\Users\admin\AppData\Local\Temp\KeePass-2.56-Setup.exe
explorer.exe
User:
admin
Company:
Dominik Reichl
Integrity Level:
MEDIUM
Description:
KeePass Password Safe 2 Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\keepass-2.56-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
7220"C:\Users\admin\AppData\Local\Temp\is-019C0.tmp\KeePass-2.56-Setup.tmp" /SL5="$802B0,6767377,844800,C:\Users\admin\AppData\Local\Temp\KeePass-2.56-Setup.exe" C:\Users\admin\AppData\Local\Temp\is-019C0.tmp\KeePass-2.56-Setup.tmp
KeePass-2.56-Setup.exe
User:
admin
Company:
Dominik Reichl
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-019c0.tmp\keepass-2.56-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
7292C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7324"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7972"C:\Users\admin\AppData\Local\KeePass Password Safe 2\KeePass.exe"C:\Users\admin\AppData\Local\KeePass Password Safe 2\KeePass.exe—KeePass-2.56-Setup.tmp
User:
admin
Company:
Dominik Reichl
Integrity Level:
MEDIUM
Description:
KeePass
Version:
2.56.0.0
Modules
Images
c:\users\admin\appdata\local\keepass password safe 2\keepass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
768
Read events
743
Write events
25
Delete events
0

Modification events

(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.1
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\KeePass Password Safe 2
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\KeePass Password Safe 2\
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
KeePass Password Safe 2
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:DisplayName
Value:
KeePass Password Safe 2 version 2.56.0.0
(PID) Process:(7220) KeePass-2.56-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{535843DD-6709-48E3-9255-3E8CC7BCC4C6}_is1
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\KeePass Password Safe 2\unins000.exe"
Executable files
15
Suspicious files
5
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\Temp\is-U073A.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\unins000.exeexecutable
MD5:A26B572C6390211C1C1D22E3B72E0D2C
SHA256:C99DAE26F0F2E539D59FD493EEA2A86AD01006EB65392430DBD9DE8C30467918
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\is-QDLMV.tmpimage
MD5:CFE840B3366BE24AEA4DAD5D0104AE85
SHA256:300F547D1E37992ED005F81497369B7EDF42F60A86ED923821AC9B88899C232E
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\is-F4AQG.tmpxml
MD5:82704DA595E970CA358D973FCD8D7858
SHA256:3D918E9FF91D0324F284A4EDC536066A924CE07B145B6AE5069963B4DF25F4D3
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\KeePass.chmbinary
MD5:39AF0D86B85C2E2EE886A8322E7030AE
SHA256:074A6E78D5D1F813A2B66B1B062FA9AE77EFCCCF871B2694E127A61512974D18
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\db.idximage
MD5:CFE840B3366BE24AEA4DAD5D0104AE85
SHA256:300F547D1E37992ED005F81497369B7EDF42F60A86ED923821AC9B88899C232E
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\is-BTDSR.tmpxml
MD5:AC0F1E104F82D295C27646BFFF39FECC
SHA256:C4A3626BBCDFE4B17759E75582AD5F89BEAA28EFC857431F373E104FBE7B8440
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\is-QJDPT.tmpexecutable
MD5:D62454972C2448BA756B4C1D2A336798
SHA256:B51DC9CA6F6029A799491BD9B8DA18C9D9775116142CEDABE958C8BCEC96A0F0
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\KeePass.exe.configxml
MD5:82704DA595E970CA358D973FCD8D7858
SHA256:3D918E9FF91D0324F284A4EDC536066A924CE07B145B6AE5069963B4DF25F4D3
7220KeePass-2.56-Setup.tmpC:\Users\admin\AppData\Local\KeePass Password Safe 2\is-ASU7D.tmpexecutable
MD5:D62454972C2448BA756B4C1D2A336798
SHA256:B51DC9CA6F6029A799491BD9B8DA18C9D9775116142CEDABE958C8BCEC96A0F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
18
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7732
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7732
SIHClient.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.26
  • 2.16.164.17
  • 2.16.164.34
  • 2.16.164.42
  • 2.16.164.107
  • 2.16.164.99
  • 2.16.164.9
  • 2.16.164.16
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KeePass-2.56-Setup.exe