File name:

Setup1.exe

Full analysis: https://app.any.run/tasks/11c9393c-5ef3-4c71-af11-1c5714a3d644
Verdict: Malicious activity
Threats:

DarkGate is a loader, which possesses extensive functionality, ranging from keylogging to crypto mining. Written in Delphi, this malware is known for the use of AutoIT scripts in its infection process. Thanks to this malicious software’s versatile architecture, it is widely used by established threat actors.

Malware Trends Tracker     >>>
Analysis date: August 12, 2024, 13:39:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
expiro
sinkhole
m0yv
rat
darkgate
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

176ABCDF359BD0F1FBB11741C88876FC

SHA1:

BD5B19FCA023300EF18FFE3F08179D9CB45A0C9E

SHA256:

01FDCC1B190A64A5DD5D0B8EFF108A9481E200FA315FAD2D5BD902EFDB9E392B

SSDEEP:

49152:b+zj1C/cMAHTTXFSmQ9jj6zCioX9RiZcXTWpufIM6wxFelLVc55:b+zjIkMAHTTd0HioX3i6XTWpgI5wxkmz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • Setup1.exe (PID: 6428)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • alg.exe (PID: 6528)
      • AppVClient.exe (PID: 6572)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 6612)
      • FXSSVC.exe (PID: 6932)
      • elevation_service.exe (PID: 7164)
      • elevation_service.exe (PID: 6052)
      • maintenanceservice.exe (PID: 5552)
      • msdtc.exe (PID: 188)
      • PerceptionSimulationService.exe (PID: 6208)
      • PSEXESVC.exe (PID: 2872)
      • Locator.exe (PID: 6524)
      • snmptrap.exe (PID: 6944)
      • SensorDataService.exe (PID: 6856)
      • Spectrum.exe (PID: 6956)
      • ssh-agent.exe (PID: 6888)
      • TieringEngineService.exe (PID: 5924)
      • AgentService.exe (PID: 6576)
      • vds.exe (PID: 7208)
      • VSSVC.exe (PID: 7280)
      • wbengine.exe (PID: 7352)
      • WmiApSrv.exe (PID: 7408)
      • SearchIndexer.exe (PID: 7468)

    • M0YV has been detected (YARA)

      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 6612)
      • armsvc.exe (PID: 6464)
      • alg.exe (PID: 6528)
      • Spectrum.exe (PID: 6956)
      • GameInputSvc.exe (PID: 7076)
      • GameInputSvc.exe (PID: 7120)
      • elevation_service.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 6308)
      • GoogleUpdate.exe (PID: 5388)
      • elevation_service.exe (PID: 6052)

    • Connects to the CnC server

      • Setup1.exe (PID: 6428)

    • Actions looks like stealing of personal data

      • alg.exe (PID: 6528)

    • EXPIRO has been detected (SURICATA)

      • Setup1.exe (PID: 6428)

    • Expiro has been found (SURICATA)

      • Setup1.exe (PID: 6428)

    • Request for a sinkholed resource

      • Setup1.exe (PID: 6428)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Setup1.exe (PID: 6428)

    • Executes as Windows Service

      • alg.exe (PID: 6528)
      • AppVClient.exe (PID: 6572)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • armsvc.exe (PID: 6464)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 6612)
      • GameInputSvc.exe (PID: 7076)
      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • FXSSVC.exe (PID: 6932)
      • GoogleUpdate.exe (PID: 32)
      • maintenanceservice.exe (PID: 5552)
      • msdtc.exe (PID: 188)
      • perfhost.exe (PID: 6220)
      • MicrosoftEdgeUpdate.exe (PID: 6160)
      • PerceptionSimulationService.exe (PID: 6208)
      • PSEXESVC.exe (PID: 2872)
      • Locator.exe (PID: 6524)
      • Spectrum.exe (PID: 6956)
      • SensorDataService.exe (PID: 6856)
      • vds.exe (PID: 7208)
      • VSSVC.exe (PID: 7280)
      • snmptrap.exe (PID: 6944)
      • ssh-agent.exe (PID: 6888)
      • TieringEngineService.exe (PID: 5924)
      • AgentService.exe (PID: 6576)
      • wbengine.exe (PID: 7352)
      • WmiApSrv.exe (PID: 7408)
      • GoogleUpdate.exe (PID: 9192)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • GoogleUpdate.exe (PID: 32)
      • GameInputSvc.exe (PID: 7076)
      • GoogleUpdate.exe (PID: 5388)
      • MicrosoftEdgeUpdate.exe (PID: 6160)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6956)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7100)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6252)

    • Process drops legitimate windows executable

      • Setup1.exe (PID: 6428)
      • alg.exe (PID: 6528)

    • Executable content was dropped or overwritten

      • Setup1.exe (PID: 6428)
      • alg.exe (PID: 6528)

    • Contacting a server suspected of hosting an CnC

      • Setup1.exe (PID: 6428)

  • INFO

    • Checks supported languages

      • Setup1.exe (PID: 6428)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • armsvc.exe (PID: 6464)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6956)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7100)
      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6252)
      • elevation_service.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 6308)
      • GoogleUpdate.exe (PID: 32)
      • GoogleUpdate.exe (PID: 5388)
      • elevation_service.exe (PID: 6052)
      • GoogleCrashHandler.exe (PID: 6400)
      • maintenanceservice.exe (PID: 5552)
      • GoogleCrashHandler64.exe (PID: 3356)
      • GoogleUpdate.exe (PID: 6380)
      • GoogleUpdate.exe (PID: 4644)
      • MicrosoftEdgeUpdate.exe (PID: 6160)
      • PSEXESVC.exe (PID: 2872)
      • MicrosoftEdgeUpdate.exe (PID: 6600)
      • ssh-agent.exe (PID: 6888)

    • Reads the computer name

      • Setup1.exe (PID: 6428)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • armsvc.exe (PID: 6464)
      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6956)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6252)
      • MicrosoftEdgeUpdate.exe (PID: 6308)
      • elevation_service.exe (PID: 7164)
      • GoogleUpdate.exe (PID: 32)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7100)
      • GoogleUpdate.exe (PID: 5388)
      • elevation_service.exe (PID: 6052)
      • GoogleCrashHandler.exe (PID: 6400)
      • GoogleUpdate.exe (PID: 6380)
      • maintenanceservice.exe (PID: 5552)
      • GoogleCrashHandler64.exe (PID: 3356)
      • MicrosoftEdgeUpdate.exe (PID: 6160)
      • PSEXESVC.exe (PID: 2872)
      • GoogleUpdate.exe (PID: 4644)
      • MicrosoftEdgeUpdate.exe (PID: 6600)
      • ssh-agent.exe (PID: 6888)

    • Creates files or folders in the user directory

      • Setup1.exe (PID: 6428)
      • GoogleUpdate.exe (PID: 6380)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 6932)
      • GoogleUpdate.exe (PID: 32)
      • GoogleUpdate.exe (PID: 5388)
      • GoogleUpdate.exe (PID: 6380)
      • maintenanceservice.exe (PID: 5552)
      • GoogleUpdate.exe (PID: 4644)
      • SearchIndexer.exe (PID: 7468)

    • Executes as Windows Service

      • elevation_service.exe (PID: 7164)
      • elevation_service.exe (PID: 6052)
      • SearchIndexer.exe (PID: 7468)

    • Reads the software policy settings

      • GameInputSvc.exe (PID: 7120)
      • GoogleUpdate.exe (PID: 6380)
      • MicrosoftEdgeUpdate.exe (PID: 6600)
      • MicrosoftEdgeUpdate.exe (PID: 6160)

    • Checks proxy server information

      • Setup1.exe (PID: 6428)

    • Checks transactions between databases Windows and Oracle

      • msdtc.exe (PID: 188)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6600)

    • Reads the time zone

      • TieringEngineService.exe (PID: 5924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:03:16 00:57:30+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 53248
InitializedDataSize: 65536
UninitializedDataSize: -
EntryPoint: 0x32f7
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Brother Industries, Ltd.
FileDescription: Small Setup
FileVersion: 1, 0, 0, 4
InternalName: SSetup
LegalCopyright: Copyright (C) 2010
OriginalFileName: SSetup.exe
ProductName: SSetup
ProductVersion: 1, 0, 0, 4
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
180
Monitored processes
46
Malicious processes
33
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV setup1.exe #M0YV armsvc.exe no specs #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe no specs microsoftedgeupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs #M0YV fxssvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs #M0YV elevation_service.exe no specs microsoftedgeupdatecomregistershell64.exe no specs googleupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs #M0YV googleupdate.exe no specs #M0YV elevation_service.exe no specs googleupdate.exe googlecrashhandler.exe no specs googlecrashhandler64.exe no specs #M0YV maintenanceservice.exe no specs googleupdate.exe no specs #M0YV msdtc.exe no specs microsoftedgeupdate.exe #M0YV perceptionsimulationservice.exe no specs perfhost.exe no specs #M0YV psexesvc.exe no specs #M0YV locator.exe no specs microsoftedgeupdate.exe #M0YV sensordataservice.exe no specs #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs Delivery Optimization User no specs #M0YV agentservice.exe no specs #M0YV vds.exe no specs #M0YV vssvc.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs googleupdate.exe no specs setup1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svcC:\Program Files (x86)\Google\Update\GoogleUpdate.exe—services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
188C:\WINDOWS\System32\msdtc.exeC:\Windows\System32\msdtc.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Distributed Transaction Coordinator Service
Version:
2001.12.10941.16384 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msdtc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msdtctm.dll
c:\windows\system32\oleaut32.dll
2872C:\WINDOWS\PSEXESVC.exeC:\Windows\PSEXESVC.exe
services.exe
User:
SYSTEM
Company:
Sysinternals
Integrity Level:
SYSTEM
Description:
PsExec Service
Version:
2.34
Modules
Images
c:\windows\psexesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3356"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googlecrashhandler64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4644"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource coreC:\Program Files (x86)\Google\Update\GoogleUpdate.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Installer
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5388"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cC:\Program Files (x86)\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Installer
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5552"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
services.exe
User:
SYSTEM
Company:
Mozilla Foundation
Integrity Level:
SYSTEM
Exit code:
0
Version:
123.0
Modules
Images
c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
5924C:\WINDOWS\system32\TieringEngineService.exeC:\Windows\System32\TieringEngineService.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Storage Tiers Management
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tieringengineservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6052"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6160"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
Total events
25 261
Read events
23 895
Write events
1 293
Delete events
73

Modification events

(PID) Process:(6464) armsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM
Operation:writeName:iLastSvcSuccess
Value:
944640
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:omaha_version
Value:
1100B90003000100
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans
Operation:writeName:is_system_install
Value:
01000000
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_main
Value:
1500000000000000
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_constructor
Value:
1500000000000000
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:windows_major_version
Value:
0A00000000000000
(PID) Process:(6812) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:InstallTime
Value:
(PID) Process:(6812) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
Operation:writeName:InstallTime
Value:
(PID) Process:(6860) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(6860) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
145
Suspicious files
7
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428Setup1.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:F9B9444D3DEB89E18D0D50344AC2749B
SHA256:FA3F1607EBD663C1A3E066512F5603937D069DE2F9F9FB8AC4213FC1D4906479
6428Setup1.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeexecutable
MD5:CDABA79FF786383774DFEFB1D85E0627
SHA256:09498E781260208978344BA50E6C6EF65DC1FC29D101D18D7178F54E65F2F464
6528alg.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:3CD85AC19DD1006FC1E10FA7E693E9DB
SHA256:A6288DAF62558F2E43B56F1B7A4F9662194F56D534313B577691520496F2E50B
6428Setup1.exeC:\Windows\System32\FXSSVC.exeexecutable
MD5:E1AD18FD2581E65F29BEA07E31FAAC86
SHA256:68A4DE249DED3E839425976BC2A2DB960418E609821139595E4D9E918F7E8944
6428Setup1.exeC:\Windows\System32\AppVClient.exeexecutable
MD5:7A3B0796991041EDCA76FFF63CE45BA9
SHA256:C1A87C88DAF59681679B95CDD8D398668500B7AEA2B2EE5D7EB600E7EA23A05A
6428Setup1.exeC:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeexecutable
MD5:6B85590D0BF893146682E99BAD2A3257
SHA256:E51D2A257FE1831DBFDF272494FFE181EBC8219F0CFC761CDD214359FD83519C
6428Setup1.exeC:\Windows\System32\alg.exeexecutable
MD5:558D5345CD0F9BFBE77ADD24E2721B1A
SHA256:F16BC053107B319FBD337BF76F8084053A29BB3A47C78F9FA272447CBA31BFB2
6428Setup1.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeexecutable
MD5:94B612904E7D391D5105238C3981078C
SHA256:33B33D55C14E5FAFA959A1E6DB99E2C6872D596A8969383DF261944FE7BDC153
6652MicrosoftEdgeUpdate.exeC:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logtext
MD5:1E8D3037AC72A2F4762A056B2CBC7470
SHA256:820D8CB9287DFA57601745818966693642F40C2932319232A7D44FFA267BA6CB
6428Setup1.exeC:\Windows\System32\GameInputSvc.exeexecutable
MD5:A59E55D256372660140906FCF6048650
SHA256:18C2529E928E2D88938FDC10C33EE33BD34D5075E7C43EA66BF61DC15CB69C52
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
343
TCP/UDP connections
57
DNS requests
42
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6428
Setup1.exe
POST
200
54.244.188.177:80
http://pywolwnvd.biz/ybqgnuhijpba
unknown
—
—
unknown
6528
alg.exe
POST
200
54.244.188.177:80
http://pywolwnvd.biz/aqyyxaerrxhep
unknown
—
—
unknown
6528
alg.exe
POST
200
18.141.10.107:80
http://ssbzmoy.biz/wvq
unknown
—
—
unknown
6428
Setup1.exe
POST
200
18.141.10.107:80
http://ssbzmoy.biz/lfxniekyihsglwau
unknown
—
—
unknown
6428
Setup1.exe
POST
200
54.244.188.177:80
http://cvgrf.biz/xgvdmb
unknown
—
—
unknown
6528
alg.exe
POST
200
44.221.84.105:80
http://npukfztj.biz/bwbxn
unknown
—
—
unknown
6428
Setup1.exe
POST
—
172.234.222.143:80
http://przvgke.biz/lqppfmuu
unknown
—
—
unknown
6864
svchost.exe
GET
200
152.199.19.161:80
http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/01a02d0e-9d8d-47a3-8c36-9bf38dabe21a/pieceshash
unknown
—
—
whitelisted
6528
alg.exe
POST
200
54.244.188.177:80
http://cvgrf.biz/ahamk
unknown
—
—
unknown
6428
Setup1.exe
POST
200
44.221.84.105:80
http://npukfztj.biz/lvysmha
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3376
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4936
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6428
Setup1.exe
54.244.188.177:80
pywolwnvd.biz
AMAZON-02
US
unknown
—
—
54.244.188.177:80
pywolwnvd.biz
AMAZON-02
US
unknown
6428
Setup1.exe
18.141.10.107:80
ssbzmoy.biz
AMAZON-02
SG
unknown
—
—
18.141.10.107:80
ssbzmoy.biz
AMAZON-02
SG
unknown
6380
GoogleUpdate.exe
142.250.186.46:443
clients2.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
pywolwnvd.biz
  • 54.244.188.177
unknown
ssbzmoy.biz
  • 18.141.10.107
unknown
clients2.google.com
  • 142.250.186.46
whitelisted
cvgrf.biz
  • 54.244.188.177
malicious
npukfztj.biz
  • 44.221.84.105
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 13.95.26.4
whitelisted
przvgke.biz
  • 172.234.222.143
  • 172.234.222.138
unknown
geo.prod.do.dsp.mp.microsoft.com
  • 40.69.74.80
whitelisted

Threats

PID
Process
Class
Message
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
—
—
A Network Trojan was detected
ET MALWARE DNS Query to DarkGate/Expiro Related Domain (knjghuig .biz)
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup1.exe