download:

/gds/2/0100012162/03/mastersetupv110.exe

Full analysis: https://app.any.run/tasks/442b002e-b1c0-4e02-a693-92a95bac79c5
Verdict: Malicious activity
Analysis date: November 22, 2024, 09:32:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

C930FB574502BECA03B610B3BC3A8E9E

SHA1:

90C7135941E9090EE0D29681364EF6871FFF7FFB

SHA256:

00D70F6FC7298D4E8F9780338C66D00D8BDF738513CBA9FF12B1F59DAEC5D801

SSDEEP:

98304:usmykJTbyx52LhbHDTwPvRHBnCDonE60/iViikustBdg7XysuVybPvHiyBdp6GQv:0dSP6s6BPfl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • mastersetupv110.exe (PID: 5576)

    • Process drops legitimate windows executable

      • mastersetupv110.exe (PID: 5576)
      • ndp462-kb3151802-web.exe (PID: 6812)

    • Executable content was dropped or overwritten

      • mastersetupv110.exe (PID: 5576)
      • ndp462-kb3151802-web.exe (PID: 6812)

    • The process creates files with name similar to system file names

      • mastersetupv110.exe (PID: 5576)

  • INFO

    • Checks supported languages

      • mastersetupv110.exe (PID: 5576)
      • Msetup4.exe (PID: 2008)

    • The process uses the downloaded file

      • mastersetupv110.exe (PID: 5576)

    • Manual execution by a user

      • mastersetupv110.exe (PID: 7068)
      • mastersetupv110.exe (PID: 7116)
      • Msetup4.exe (PID: 3852)
      • Msetup4.exe (PID: 6624)
      • ndp462-kb3151802-web.exe (PID: 4976)
      • ndp462-kb3151802-web.exe (PID: 6812)

    • Process checks computer location settings

      • mastersetupv110.exe (PID: 5576)

    • Reads the computer name

      • mastersetupv110.exe (PID: 5576)
      • Msetup4.exe (PID: 2008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (30.7)
.exe | Win32 Executable MS Visual C++ (generic) (22.2)
.exe | Win64 Executable (generic) (19.7)
.exe | Winzip Win32 self-extracting archive (generic) (16.4)
.dll | Win32 Dynamic Link Library (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:11:02 20:23:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 151552
InitializedDataSize: 77824
UninitializedDataSize: -
EntryPoint: 0x14bdf
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
13
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start mastersetupv110.exe msetup4.exe no specs textinputhost.exe no specs rundll32.exe no specs mastersetupv110.exe no specs mastersetupv110.exe msetup4.exe no specs msetup4.exe no specs msetup4.exe ndp462-kb3151802-web.exe no specs ndp462-kb3151802-web.exe setup.exe no specs mastersetupv110.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2008"C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe" C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe—mastersetupv110.exe
User:
admin
Company:
CANON INC.
Integrity Level:
HIGH
Description:
Master Setup
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\downloads\mastersetupv110\msetup4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3672"C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe" C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe—mastersetupv110.exe
User:
admin
Company:
CANON INC.
Integrity Level:
HIGH
Description:
Master Setup
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\downloads\mastersetupv110\msetup4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3852"C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe" C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe—explorer.exe
User:
admin
Company:
CANON INC.
Integrity Level:
MEDIUM
Description:
Master Setup
Exit code:
3221226540
Version:
1.1.0.0
Modules
Images
c:\users\admin\downloads\mastersetupv110\msetup4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4036C:\6508183a1fd450bdf0652e33101f\\Setup.exe /x86 /x64 /webC:\6508183a1fd450bdf0652e33101f\Setup.exe—ndp462-kb3151802-web.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Version:
14.6.1590.0 built by: NETFXREL2
Modules
Images
c:\6508183a1fd450bdf0652e33101f\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4228"C:\Users\admin\Downloads\mastersetupv110.exe" C:\Users\admin\Downloads\mastersetupv110.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\mastersetupv110.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4976"C:\Users\admin\Downloads\mastersetupv110\Launcher\DotNet\ndp462-kb3151802-web.exe" C:\Users\admin\Downloads\mastersetupv110\Launcher\DotNet\ndp462-kb3151802-web.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.6.2 Setup
Exit code:
3221226540
Version:
4.6.01590.00
Modules
Images
c:\users\admin\downloads\mastersetupv110\launcher\dotnet\ndp462-kb3151802-web.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5576"C:\Users\admin\Downloads\mastersetupv110.exe" C:\Users\admin\Downloads\mastersetupv110.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\mastersetupv110.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6624"C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe" C:\Users\admin\Downloads\mastersetupv110\Msetup4.exe
explorer.exe
User:
admin
Company:
CANON INC.
Integrity Level:
HIGH
Description:
Master Setup
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\downloads\mastersetupv110\msetup4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6812"C:\Users\admin\Downloads\mastersetupv110\Launcher\DotNet\ndp462-kb3151802-web.exe" C:\Users\admin\Downloads\mastersetupv110\Launcher\DotNet\ndp462-kb3151802-web.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.6.2 Setup
Version:
4.6.01590.00
Modules
Images
c:\users\admin\downloads\mastersetupv110\launcher\dotnet\ndp462-kb3151802-web.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6872"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
1 424
Read events
1 424
Write events
0
Delete events
0

Modification events

No data
Executable files
102
Suspicious files
3
Text files
117
Unknown types
0

Dropped files

PID
Process
Filename
Type
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\Common.AppModel.dllexecutable
MD5:214D2281530E2263A96A0A459F056D38
SHA256:55B0845CF4BF8936E9A74197B14836D122CC8F68934844BA4294041F00E68DDC
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\ar-SA\ESetup.View.resources.dllexecutable
MD5:14C1AC7165C90A78055BDEA3E3688A0D
SHA256:A0E7FEFE96A014FD91AB013F13576875D350FF17D3B2D071EE5DE7DDDB3AB9A2
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\Common.View.dllexecutable
MD5:648474D8F78C62BD2933CA48A43E9770
SHA256:4984DF55A078D2774228DC765BA9FEC5DB557148785AFB20787D8A7E75CE1073
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\Common.Logger.dllexecutable
MD5:0639DF845B7417BFAF28A9FF9ADC456A
SHA256:4E8C34B564F67B8F8FFF67B4427D20F1A83CB498C8F7BD9BA39F9E31AE8201A9
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\EP.Setup.Service.dllexecutable
MD5:97403889ABFBA45D9E7B74C2987BB1B0
SHA256:8DE121C1314712A6463CC504EE38A06B743B3CD7C25FEB6660BFE252F97AC314
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\de-DE\ESetup.View.resources.dllexecutable
MD5:34F1FC1B5091D74237EE9325200F222C
SHA256:90FA6533F8388E7DD25784B52EF7102CB20A0E0C0634D4D1C6C3066D399ED1F3
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\Common.Utility.dllexecutable
MD5:11ABE7399296BCEB5720BD1F10756044
SHA256:90DF5A20E17A5EA013D4A9307971605615FA4EC3F5E9B4275217F28824DC4EEB
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\ESetup.Route.dllexecutable
MD5:6281FD294BBB543CD0A17F38AA693B0E
SHA256:F751CD002D6E74AF25ABFCC7973E2BF49B85DD1AC5E7D71DD65CFF1D9BACE1D3
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\cs-CZ\ESetup.View.resources.dllexecutable
MD5:7BDB2E92BB6D25E5F22082C592DEB655
SHA256:D01824DA6B8B6838394FC17575C6D06F83E3001BE570819AB22B2FFEB52604E2
5576mastersetupv110.exeC:\Users\admin\Downloads\mastersetupv110\win\es-ES\ESetup.View.resources.dllexecutable
MD5:A23F8C06750355BCF14466E839D8CE59
SHA256:EBF52B816E679B7E4B81693530A09F051203A5D7F2E95AC89B42DC4CDF129894
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
36
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6100
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6700
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6700
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
492
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6100
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6024
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.107:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4932
svchost.exe
2.16.164.107:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4932
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.19.96.72:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.107
  • 2.16.164.112
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.52.120.96
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 2.19.96.72
  • 2.19.96.74
  • 2.19.96.75
  • 2.19.96.83
  • 2.19.96.88
  • 2.19.96.73
  • 2.19.96.89
  • 2.19.96.91
  • 2.19.96.81
  • 2.23.209.181
  • 2.23.209.178
  • 2.23.209.171
  • 2.23.209.168
  • 2.23.209.173
  • 2.23.209.183
  • 2.23.209.185
  • 2.23.209.175
  • 2.23.209.179
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.43.62.58
whitelisted
cxcs.microsoft.net
  • 184.25.219.220
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/gds/2/0100012162/03/mastersetupv110.exe