File name:

setup_x86_x64_install.exe

Full analysis: https://app.any.run/tasks/d20f364e-f5c0-432c-99d3-98c6a79ec862
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 13, 2025, 18:42:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
evasion
pastebin
stealer
smoke
loader
smokeloader
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

AAFA1EC51E98D09067A40037B36D65B7

SHA1:

0C3F506EDA6379BD3D7A37228695887B1F08C7A3

SHA256:

01DA2BC782511CF598DB51A1FF74B24B151CFCB25B53395CDA5863C6F5181670

SSDEEP:

98304:ba8RCTBE30lec5bDj2ugFhm3RUqzBmC6JK5gkAOnRNf+PDfLl3oEo2dCebtmS8Cs:2H6pyFSPLoQ798

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • setup_install.exe (PID: 3100)
      • cmd.exe (PID: 5936)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 896)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 896)

    • Changes Windows Defender settings

      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 5176)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Changes settings for real-time protection

      • powershell.exe (PID: 896)

    • Executing a file with an untrusted certificate

      • Tue10c32e38b2f7a.exe (PID: 5056)
      • Tue100b98315cb6a2462.exe (PID: 1180)
      • Tue1097154f7bea25929.exe (PID: 2772)
      • Tue1091ca8211.exe (PID: 2108)
      • Tue1097154f7bea25929.exe (PID: 6828)

    • Signed with known abused certificate

      • cmd.exe (PID: 4920)

    • Actions looks like stealing of personal data

      • Tue10ceee940a.exe (PID: 6752)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • Tue102edff307.exe (PID: 6080)

    • SMOKE mutex has been found

      • explorer.exe (PID: 5492)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • Tue10a7dac8532.exe (PID: 3888)
      • Tue1081b1dda619bd77.exe (PID: 1072)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • Tue1081b1dda619bd77.exe (PID: 7576)
      • Tue1081b1dda619bd77.tmp (PID: 7688)
      • cmd.exe (PID: 7852)
      • cmd.exe (PID: 4180)
      • explorer.exe (PID: 5492)

    • Reads security settings of Internet Explorer

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • Tue10e775af280328dd.exe (PID: 1096)
      • Tue104f444f066d35c0.exe (PID: 2088)
      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue1081b1dda619bd77.tmp (PID: 7688)
      • h02CuYYeZUcMDD.exe (PID: 7916)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue103f1524a41.exe (PID: 4464)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue10a34379efb.exe (PID: 2040)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Drops 7-zip archiver for unpacking

      • setup_x86_x64_install.exe (PID: 4976)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 5936)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3100)
      • mshta.exe (PID: 7444)
      • mshta.exe (PID: 8048)
      • cmd.exe (PID: 4180)
      • mshta.exe (PID: 4844)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 5176)

    • The executable file from the user directory is run by the CMD process

      • Tue1081b1dda619bd77.exe (PID: 1072)
      • Tue100b98315cb6a2462.exe (PID: 1180)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue10c32e38b2f7a.exe (PID: 5056)
      • Tue10a7dac8532.exe (PID: 3888)
      • Tue10cf7e73ad783be.exe (PID: 5984)
      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue10e775af280328dd.exe (PID: 1096)
      • Tue102edff307.exe (PID: 6080)
      • Tue10ceee940a.exe (PID: 6752)
      • Tue103f1524a41.exe (PID: 4464)
      • Tue1097154f7bea25929.exe (PID: 2772)
      • Tue10a34379efb.exe (PID: 2040)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue1091ca8211.exe (PID: 2108)
      • Tue1015aa11987be.exe (PID: 6644)
      • Tue104f444f066d35c0.exe (PID: 2088)
      • Tue101cd35a71f263b2.exe (PID: 6512)
      • h02CuYYeZUcMDD.exe (PID: 7916)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 5936)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 5936)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Reads the Windows owner or organization settings

      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue1081b1dda619bd77.tmp (PID: 7688)

    • Process drops legitimate windows executable

      • Tue10a7dac8532.tmp (PID: 6324)

    • Reads the BIOS version

      • Tue100b98315cb6a2462.exe (PID: 1180)

    • Application launched itself

      • Tue10e775af280328dd.exe (PID: 1096)
      • cmd.exe (PID: 4180)
      • Tue1015aa11987be.exe (PID: 6644)
      • Tue101cd35a71f263b2.exe (PID: 6512)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Executes application which crashes

      • Tue1091ca8211.exe (PID: 2108)
      • Tue10c32e38b2f7a.exe (PID: 5056)
      • Tue102edff307.exe (PID: 6080)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)
      • Tue103749bf3d2fd8e89.exe (PID: 5964)

    • Connects to the server without a host name

      • Tue10a34379efb.exe (PID: 2040)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue1097154f7bea25929.exe (PID: 6828)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Tue10ceee940a.exe (PID: 6752)
      • Tue103749bf3d2fd8e89.exe (PID: 5964)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 7852)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 8048)
      • mshta.exe (PID: 7444)
      • mshta.exe (PID: 4844)

    • Connects to unusual port

      • Tue100b98315cb6a2462.exe (PID: 1180)
      • Tue1015aa11987be.exe (PID: 7880)
      • Tue101cd35a71f263b2.exe (PID: 7188)

    • Access to an unwanted program domain was detected

      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue10a34379efb.exe (PID: 2040)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 7500)

  • INFO

    • Checks supported languages

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • setup_install.exe (PID: 3100)
      • Tue1081b1dda619bd77.exe (PID: 1072)
      • Tue10c32e38b2f7a.exe (PID: 5056)
      • Tue10cf7e73ad783be.exe (PID: 5984)
      • Tue1097154f7bea25929.exe (PID: 2772)
      • Tue100b98315cb6a2462.exe (PID: 1180)
      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue102edff307.exe (PID: 6080)
      • Tue10a7dac8532.exe (PID: 3888)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue103f1524a41.exe (PID: 4464)
      • Tue10ceee940a.exe (PID: 6752)
      • Tue10a34379efb.exe (PID: 2040)
      • Tue1015aa11987be.exe (PID: 6644)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue104f444f066d35c0.exe (PID: 2088)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue101cd35a71f263b2.exe (PID: 6512)
      • Tue1091ca8211.exe (PID: 2108)
      • Tue10e775af280328dd.exe (PID: 1096)
      • Tue10e775af280328dd.exe (PID: 7492)
      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • Tue1081b1dda619bd77.exe (PID: 7576)
      • Tue1081b1dda619bd77.tmp (PID: 7688)
      • h02CuYYeZUcMDD.exe (PID: 7916)
      • Tue101cd35a71f263b2.exe (PID: 7188)
      • Tue1015aa11987be.exe (PID: 7880)
      • Tue1097154f7bea25929.exe (PID: 6828)

    • Create files in a temporary directory

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • Tue10a7dac8532.exe (PID: 3888)
      • Tue1081b1dda619bd77.exe (PID: 1072)
      • Tue104f444f066d35c0.exe (PID: 2088)
      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue103f1524a41.exe (PID: 4464)
      • Tue1081b1dda619bd77.exe (PID: 7576)
      • Tue1081b1dda619bd77.tmp (PID: 7688)
      • h02CuYYeZUcMDD.exe (PID: 7916)

    • Reads the computer name

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • Tue10ceee940a.exe (PID: 6752)
      • Tue10cf7e73ad783be.exe (PID: 5984)
      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue1015aa11987be.exe (PID: 6644)
      • Tue101cd35a71f263b2.exe (PID: 6512)
      • Tue1097154f7bea25929.exe (PID: 2772)
      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • Tue104f444f066d35c0.exe (PID: 2088)
      • Tue10e775af280328dd.exe (PID: 1096)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue103f1524a41.exe (PID: 4464)
      • Tue100b98315cb6a2462.exe (PID: 1180)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue10a34379efb.exe (PID: 2040)
      • Tue10e775af280328dd.exe (PID: 7492)
      • Tue1081b1dda619bd77.tmp (PID: 7688)
      • h02CuYYeZUcMDD.exe (PID: 7916)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue1015aa11987be.exe (PID: 7880)
      • Tue101cd35a71f263b2.exe (PID: 7188)
      • Tue1097154f7bea25929.exe (PID: 6828)

    • The sample compiled with english language support

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • Tue10a7dac8532.tmp (PID: 6324)

    • Process checks computer location settings

      • setup_x86_x64_install.exe (PID: 4976)
      • setup_installer.exe (PID: 4740)
      • Tue10e775af280328dd.exe (PID: 1096)
      • Tue104f444f066d35c0.exe (PID: 2088)
      • Tue1081b1dda619bd77.tmp (PID: 5064)
      • h02CuYYeZUcMDD.exe (PID: 7916)
      • Tue103f1524a41.exe (PID: 4464)
      • Tue1097154f7bea25929.exe (PID: 2772)

    • Checks proxy server information

      • Tue10ceee940a.exe (PID: 6752)
      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue10cf7e73ad783be.exe (PID: 5984)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue1081b1dda619bd77.tmp (PID: 7688)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue10a34379efb.exe (PID: 2040)
      • explorer.exe (PID: 5492)

    • Reads the machine GUID from the registry

      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue1097154f7bea25929.exe (PID: 2772)
      • Tue10cf7e73ad783be.exe (PID: 5984)
      • Tue1015aa11987be.exe (PID: 6644)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue101cd35a71f263b2.exe (PID: 6512)
      • Tue100b98315cb6a2462.exe (PID: 1180)
      • Tue10e775af280328dd.exe (PID: 7492)
      • Tue10c4d48f1b7f5.exe (PID: 736)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue101cd35a71f263b2.exe (PID: 7188)
      • Tue1015aa11987be.exe (PID: 7880)

    • Disables trace logs

      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue10cf7e73ad783be.exe (PID: 5984)

    • Reads Environment values

      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue10cf7e73ad783be.exe (PID: 5984)

    • Process checks whether UAC notifications are on

      • Tue100b98315cb6a2462.exe (PID: 1180)

    • Reads the software policy settings

      • Tue103749bf3d2fd8e89.exe (PID: 5964)
      • Tue10a7dac8532.tmp (PID: 6324)
      • Tue10e775af280328dd.exe (PID: 7492)
      • Tue1074226f2f6.exe (PID: 1280)
      • Tue10c4d48f1b7f5.exe (PID: 736)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7444)
      • mshta.exe (PID: 8048)
      • mshta.exe (PID: 4844)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7608)
      • WerFault.exe (PID: 7624)
      • WerFault.exe (PID: 8092)
      • explorer.exe (PID: 5492)

    • Compiled with Borland Delphi (YARA)

      • conhost.exe (PID: 6744)
      • cmd.exe (PID: 5936)

    • Reads security settings of Internet Explorer

      • control.exe (PID: 7860)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5404)
      • powershell.exe (PID: 896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:08:01 02:44:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x35d8
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
209
Monitored processes
80
Malicious processes
21
Suspicious processes
13

Behavior graph

Click at the process to see the details
start setup_x86_x64_install.exe setup_installer.exe setup_install.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs tue1081b1dda619bd77.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs tue1074226f2f6.exe tue10c32e38b2f7a.exe tue100b98315cb6a2462.exe tue10a7dac8532.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs tue1097154f7bea25929.exe no specs tue10cf7e73ad783be.exe no specs tue103749bf3d2fd8e89.exe tue102edff307.exe tue10e775af280328dd.exe no specs tue10ceee940a.exe tue103f1524a41.exe no specs tue10a34379efb.exe tue10c4d48f1b7f5.exe tue1015aa11987be.exe no specs tue104f444f066d35c0.exe no specs tue1091ca8211.exe tue10a7dac8532.tmp tue101cd35a71f263b2.exe no specs tue1081b1dda619bd77.tmp mshta.exe no specs tue10e775af280328dd.exe tue1081b1dda619bd77.exe svchost.exe werfault.exe no specs werfault.exe no specs tue1081b1dda619bd77.tmp cmd.exe conhost.exe no specs h02cuyyezucmdd.exe no specs taskkill.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs tue1015aa11987be.exe tue101cd35a71f263b2.exe mshta.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs odbcconf.exe werfault.exe no specs control.exe no specs rundll32.exe no specs #SMOKE explorer.exe powershell.exe no specs conhost.exe no specs tue1097154f7bea25929.exe slui.exe rundll32.exe no specs rundll32.exe no specs setup_x86_x64_install.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680C:\WINDOWS\system32\cmd.exe /c Tue10ceee940a.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
736Tue10c4d48f1b7f5.exe C:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue10c4d48f1b7f5.exe
cmd.exe
User:
admin
Company:
IcoBash
Integrity Level:
HIGH
Description:
Bash CMD
Exit code:
0
Version:
1272.2.24.5
Modules
Images
c:\users\admin\appdata\local\temp\7zs482726f0\tue10c4d48f1b7f5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
896powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting DisableC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1072Tue1081b1dda619bd77.exe C:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue1081b1dda619bd77.exe
cmd.exe
User:
admin
Company:
FarLabUninstaller soft
Integrity Level:
HIGH
Description:
FarLabUninstaller
Exit code:
1
Version:
1, 53, 0, 2
Modules
Images
c:\users\admin\appdata\local\temp\7zs482726f0\tue1081b1dda619bd77.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1096Tue10e775af280328dd.exe C:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue10e775af280328dd.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7zs482726f0\tue10e775af280328dd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1164C:\WINDOWS\system32\cmd.exe /c Tue1015aa11987be.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1180Tue100b98315cb6a2462.exe C:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue100b98315cb6a2462.exe
cmd.exe
User:
admin
Company:
mNxL8yYl
Integrity Level:
HIGH
Description:
Mqc6GEww
Version:
14,5,9,0
Modules
Images
c:\users\admin\appdata\local\temp\7zs482726f0\tue100b98315cb6a2462.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1280Tue1074226f2f6.exe C:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue1074226f2f6.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\7zs482726f0\tue1074226f2f6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1348C:\WINDOWS\system32\cmd.exe /c Tue104f444f066d35c0.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1388C:\WINDOWS\system32\cmd.exe /c Tue103f1524a41.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1001
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
55 582
Read events
55 447
Write events
119
Delete events
16

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:00000000000A00BE
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000002026A
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5964) Tue103749bf3d2fd8e89.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tue103749bf3d2fd8e89_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
39
Suspicious files
15
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
4976setup_x86_x64_install.exeC:\Users\admin\AppData\Local\Temp\nsbDEDA.tmp —
MD5:—
SHA256:—
4976setup_x86_x64_install.exeC:\Users\admin\AppData\Local\Temp\setup_installer.exeexecutable
MD5:DE0C971433D9B5C185F848F9FB83B1C2
SHA256:42D4379021C31502AA039905715476F7700F5EF4D2078E8DB3CD2D982FF40D16
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\libgcc_s_dw2-1.dllexecutable
MD5:9AEC524B616618B0D3D00B27B6F51DA1
SHA256:59A466F77584438FC3ABC0F43EDC0FC99D41851726827A008841F05CFE12DA7E
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\libstdc++-6.dllexecutable
MD5:5E279950775BAAE5FEA04D2CC4526BCC
SHA256:97DE47068327BB822B33C7106F9CBB489480901A6749513EF5C31D229DCACA87
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\setup_install.exeexecutable
MD5:91D264B0603F65A35CDB5FE597BA961A
SHA256:3DB3D53316B2632F0EEDCFA9CFB5746A1B9D835C66D8FDDF2AD8F1C33B9F82B5
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue100b98315cb6a2462.exeexecutable
MD5:0FEF60F3A25FF7257960568315547FC2
SHA256:C7105CFCF01280AD26BBAA6184675CBD41DAC98690B0DCD6D7B46235A9902099
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\libcurl.dllexecutable
MD5:D09BE1F47FD6B827C81A4812B4F7296F
SHA256:0DE53E7BE51789ADAEC5294346220B20F793E7F8D153A3C110A92D658760697E
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\libcurlpp.dllexecutable
MD5:E6E578373C2E416289A8DA55F1DC5E8E
SHA256:43E86D650A68F1F91FA2F4375AFF2720E934AA78FA3D33E06363122BF5A9535F
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue104f444f066d35c0.exeexecutable
MD5:B0E64F3DA02FE0BAC5102FE4C0F65C32
SHA256:DBC10A499E0C3BDDCFA7266D5CCE117343E0D8A164BDAA5D5DBCFEE5D5392571
4740setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS482726F0\Tue10a34379efb.exeexecutable
MD5:FB6ABBE70588DD2B3FB91161410F2805
SHA256:9283FB214B006F9E2FD49FE21798A44AE5663566B1B2B08B448DB7BDDA996859
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
109
DNS requests
56
Threats
43

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4244
RUXIMICS.exe
GET
200
23.48.23.27:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4244
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2040
Tue10a34379efb.exe
GET
—
212.193.30.45:80
http://212.193.30.45/proxies.txt
unknown
—
—
malicious
736
Tue10c4d48f1b7f5.exe
GET
—
212.193.30.45:80
http://212.193.30.45/proxies.txt
unknown
—
—
malicious
736
Tue10c4d48f1b7f5.exe
GET
—
212.193.30.29:80
http://212.193.30.29/server.txt
unknown
—
—
malicious
6752
Tue10ceee940a.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
736
Tue10c4d48f1b7f5.exe
GET
403
185.53.177.54:80
http://wfsdragon.ru/api/setStats.php
unknown
—
—
malicious
2040
Tue10a34379efb.exe
GET
—
212.193.30.29:80
http://212.193.30.29/server.txt
unknown
—
—
malicious
7288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
23.48.23.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4244
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4244
RUXIMICS.exe
23.48.23.27:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4244
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2040
Tue10a34379efb.exe
212.193.30.45:80
—
Delis LLC
CZ
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
google.com
  • 216.58.206.78
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.136
  • 20.190.160.131
  • 20.190.160.66
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.128
whitelisted
crl.microsoft.com
  • 23.48.23.27
  • 23.48.23.23
  • 23.48.23.29
  • 23.48.23.18
  • 23.48.23.16
  • 23.48.23.31
  • 23.48.23.19
  • 23.48.23.37
  • 23.48.23.24
  • 23.48.23.6
  • 23.48.23.64
  • 23.48.23.53
  • 23.48.23.46
  • 23.48.23.56
  • 23.48.23.60
  • 23.48.23.50
  • 23.48.23.44
  • 23.48.23.4
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 184.30.21.171
whitelisted
iplogger.org
  • 104.26.3.46
  • 172.67.74.161
  • 104.26.2.46
whitelisted
hammajawa7dou.s3.nl-ams.scw.cloud
  • 51.158.211.1
  • 51.158.211.0
  • 51.158.211.2
unknown
one-mature-tube.me
  • —
unknown
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in DNS Lookup)
5964
Tue103749bf3d2fd8e89.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6752
Tue10ceee940a.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
—
—
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
—
—
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
—
—
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_x86_x64_install.exe