File name:

Setup1.exe

Full analysis: https://app.any.run/tasks/11c9393c-5ef3-4c71-af11-1c5714a3d644
Verdict: Malicious activity
Threats:

DarkGate is a loader, which possesses extensive functionality, ranging from keylogging to crypto mining. Written in Delphi, this malware is known for the use of AutoIT scripts in its infection process. Thanks to this malicious software’s versatile architecture, it is widely used by established threat actors.

Malware Trends Tracker     >>>
Analysis date: August 12, 2024, 13:39:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
expiro
sinkhole
m0yv
rat
darkgate
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

176ABCDF359BD0F1FBB11741C88876FC

SHA1:

BD5B19FCA023300EF18FFE3F08179D9CB45A0C9E

SHA256:

01FDCC1B190A64A5DD5D0B8EFF108A9481E200FA315FAD2D5BD902EFDB9E392B

SSDEEP:

49152:b+zj1C/cMAHTTXFSmQ9jj6zCioX9RiZcXTWpufIM6wxFelLVc55:b+zjIkMAHTTd0HioX3i6XTWpgI5wxkmz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • Setup1.exe (PID: 6428)
      • AppVClient.exe (PID: 6572)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 6612)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • FXSSVC.exe (PID: 6932)
      • elevation_service.exe (PID: 7164)
      • elevation_service.exe (PID: 6052)
      • maintenanceservice.exe (PID: 5552)
      • alg.exe (PID: 6528)
      • msdtc.exe (PID: 188)
      • PerceptionSimulationService.exe (PID: 6208)
      • Locator.exe (PID: 6524)
      • PSEXESVC.exe (PID: 2872)
      • Spectrum.exe (PID: 6956)
      • TieringEngineService.exe (PID: 5924)
      • SensorDataService.exe (PID: 6856)
      • ssh-agent.exe (PID: 6888)
      • snmptrap.exe (PID: 6944)
      • AgentService.exe (PID: 6576)
      • vds.exe (PID: 7208)
      • VSSVC.exe (PID: 7280)
      • WmiApSrv.exe (PID: 7408)
      • SearchIndexer.exe (PID: 7468)
      • wbengine.exe (PID: 7352)

    • Connects to the CnC server

      • Setup1.exe (PID: 6428)

    • M0YV has been detected (YARA)

      • alg.exe (PID: 6528)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 6612)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • Spectrum.exe (PID: 6956)
      • GameInputSvc.exe (PID: 7076)
      • GameInputSvc.exe (PID: 7120)
      • MicrosoftEdgeUpdate.exe (PID: 6308)
      • elevation_service.exe (PID: 6052)
      • GoogleUpdate.exe (PID: 5388)
      • elevation_service.exe (PID: 7164)
      • armsvc.exe (PID: 6464)

    • EXPIRO has been detected (SURICATA)

      • Setup1.exe (PID: 6428)

    • Request for a sinkholed resource

      • Setup1.exe (PID: 6428)

    • Expiro has been found (SURICATA)

      • Setup1.exe (PID: 6428)

    • Actions looks like stealing of personal data

      • alg.exe (PID: 6528)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Setup1.exe (PID: 6428)

    • Executes as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • armsvc.exe (PID: 6464)
      • AppVClient.exe (PID: 6572)
      • FXSSVC.exe (PID: 6932)
      • GameInputSvc.exe (PID: 7076)
      • GoogleUpdate.exe (PID: 32)
      • maintenanceservice.exe (PID: 5552)
      • msdtc.exe (PID: 188)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 6612)
      • alg.exe (PID: 6528)
      • MicrosoftEdgeUpdate.exe (PID: 6160)
      • Locator.exe (PID: 6524)
      • PerceptionSimulationService.exe (PID: 6208)
      • perfhost.exe (PID: 6220)
      • PSEXESVC.exe (PID: 2872)
      • Spectrum.exe (PID: 6956)
      • ssh-agent.exe (PID: 6888)
      • vds.exe (PID: 7208)
      • SensorDataService.exe (PID: 6856)
      • snmptrap.exe (PID: 6944)
      • AgentService.exe (PID: 6576)
      • TieringEngineService.exe (PID: 5924)
      • VSSVC.exe (PID: 7280)
      • wbengine.exe (PID: 7352)
      • WmiApSrv.exe (PID: 7408)
      • GoogleUpdate.exe (PID: 9192)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • GameInputSvc.exe (PID: 7076)
      • GoogleUpdate.exe (PID: 32)
      • GoogleUpdate.exe (PID: 5388)
      • MicrosoftEdgeUpdate.exe (PID: 6160)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6956)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6252)

    • Process drops legitimate windows executable

      • Setup1.exe (PID: 6428)
      • alg.exe (PID: 6528)

    • Executable content was dropped or overwritten

      • Setup1.exe (PID: 6428)
      • alg.exe (PID: 6528)

    • Contacting a server suspected of hosting an CnC

      • Setup1.exe (PID: 6428)

  • INFO

    • Checks supported languages

      • Setup1.exe (PID: 6428)
      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • armsvc.exe (PID: 6464)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6956)
      • elevation_service.exe (PID: 7164)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6252)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7100)
      • MicrosoftEdgeUpdate.exe (PID: 6308)
      • GoogleUpdate.exe (PID: 5388)
      • GoogleUpdate.exe (PID: 32)
      • GoogleUpdate.exe (PID: 6380)
      • elevation_service.exe (PID: 6052)
      • GoogleCrashHandler.exe (PID: 6400)
      • maintenanceservice.exe (PID: 5552)
      • GoogleUpdate.exe (PID: 4644)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • GoogleCrashHandler64.exe (PID: 3356)
      • MicrosoftEdgeUpdate.exe (PID: 6160)
      • MicrosoftEdgeUpdate.exe (PID: 6600)
      • PSEXESVC.exe (PID: 2872)
      • ssh-agent.exe (PID: 6888)

    • Creates files or folders in the user directory

      • Setup1.exe (PID: 6428)
      • GoogleUpdate.exe (PID: 6380)

    • Reads the computer name

      • Setup1.exe (PID: 6428)
      • armsvc.exe (PID: 6464)
      • FlashPlayerUpdateService.exe (PID: 6492)
      • MicrosoftEdgeUpdate.exe (PID: 6652)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6956)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6252)
      • elevation_service.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 6308)
      • GoogleUpdate.exe (PID: 5388)
      • GoogleUpdate.exe (PID: 32)
      • GoogleUpdate.exe (PID: 6380)
      • elevation_service.exe (PID: 6052)
      • maintenanceservice.exe (PID: 5552)
      • GoogleCrashHandler.exe (PID: 6400)
      • GoogleUpdate.exe (PID: 4644)
      • GoogleCrashHandler64.exe (PID: 3356)
      • MicrosoftEdgeUpdate.exe (PID: 6160)
      • MicrosoftEdgeUpdate.exe (PID: 6600)
      • PSEXESVC.exe (PID: 2872)
      • ssh-agent.exe (PID: 6888)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 6932)
      • GoogleUpdate.exe (PID: 32)
      • GoogleUpdate.exe (PID: 5388)
      • GoogleUpdate.exe (PID: 6380)
      • maintenanceservice.exe (PID: 5552)
      • GoogleUpdate.exe (PID: 4644)
      • SearchIndexer.exe (PID: 7468)

    • Checks proxy server information

      • Setup1.exe (PID: 6428)

    • Executes as Windows Service

      • elevation_service.exe (PID: 7164)
      • elevation_service.exe (PID: 6052)
      • SearchIndexer.exe (PID: 7468)

    • Reads the software policy settings

      • GameInputSvc.exe (PID: 7120)
      • GoogleUpdate.exe (PID: 6380)
      • MicrosoftEdgeUpdate.exe (PID: 6600)
      • MicrosoftEdgeUpdate.exe (PID: 6160)

    • Checks transactions between databases Windows and Oracle

      • msdtc.exe (PID: 188)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6600)

    • Reads the time zone

      • TieringEngineService.exe (PID: 5924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:03:16 00:57:30+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 53248
InitializedDataSize: 65536
UninitializedDataSize: -
EntryPoint: 0x32f7
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Brother Industries, Ltd.
FileDescription: Small Setup
FileVersion: 1, 0, 0, 4
InternalName: SSetup
LegalCopyright: Copyright (C) 2010
OriginalFileName: SSetup.exe
ProductName: SSetup
ProductVersion: 1, 0, 0, 4
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
180
Monitored processes
46
Malicious processes
33
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV setup1.exe #M0YV armsvc.exe no specs #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe no specs microsoftedgeupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs #M0YV fxssvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs #M0YV elevation_service.exe no specs microsoftedgeupdatecomregistershell64.exe no specs googleupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs #M0YV googleupdate.exe no specs #M0YV elevation_service.exe no specs googleupdate.exe googlecrashhandler.exe no specs googlecrashhandler64.exe no specs #M0YV maintenanceservice.exe no specs googleupdate.exe no specs #M0YV msdtc.exe no specs microsoftedgeupdate.exe #M0YV perceptionsimulationservice.exe no specs perfhost.exe no specs #M0YV psexesvc.exe no specs #M0YV locator.exe no specs microsoftedgeupdate.exe #M0YV sensordataservice.exe no specs #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs Delivery Optimization User no specs #M0YV agentservice.exe no specs #M0YV vds.exe no specs #M0YV vssvc.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs googleupdate.exe no specs setup1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svcC:\Program Files (x86)\Google\Update\GoogleUpdate.exe—services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
188C:\WINDOWS\System32\msdtc.exeC:\Windows\System32\msdtc.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Distributed Transaction Coordinator Service
Version:
2001.12.10941.16384 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msdtc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msdtctm.dll
c:\windows\system32\oleaut32.dll
2872C:\WINDOWS\PSEXESVC.exeC:\Windows\PSEXESVC.exe
services.exe
User:
SYSTEM
Company:
Sysinternals
Integrity Level:
SYSTEM
Description:
PsExec Service
Version:
2.34
Modules
Images
c:\windows\psexesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3356"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler64.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googlecrashhandler64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4644"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource coreC:\Program Files (x86)\Google\Update\GoogleUpdate.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Installer
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5388"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cC:\Program Files (x86)\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Installer
Version:
1.3.36.51
Modules
Images
c:\program files (x86)\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5552"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
services.exe
User:
SYSTEM
Company:
Mozilla Foundation
Integrity Level:
SYSTEM
Exit code:
0
Version:
123.0
Modules
Images
c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
5924C:\WINDOWS\system32\TieringEngineService.exeC:\Windows\System32\TieringEngineService.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Storage Tiers Management
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tieringengineservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6052"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6160"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
Total events
25 261
Read events
23 895
Write events
1 293
Delete events
73

Modification events

(PID) Process:(6464) armsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM
Operation:writeName:iLastSvcSuccess
Value:
944640
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:omaha_version
Value:
1100B90003000100
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans
Operation:writeName:is_system_install
Value:
01000000
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_main
Value:
1500000000000000
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
Operation:writeName:goopdate_constructor
Value:
1500000000000000
(PID) Process:(6652) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
Operation:writeName:windows_major_version
Value:
0A00000000000000
(PID) Process:(6812) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:InstallTime
Value:
(PID) Process:(6812) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
Operation:writeName:InstallTime
Value:
(PID) Process:(6860) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(6860) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
145
Suspicious files
7
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428Setup1.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeexecutable
MD5:94B612904E7D391D5105238C3981078C
SHA256:33B33D55C14E5FAFA959A1E6DB99E2C6872D596A8969383DF261944FE7BDC153
6428Setup1.exeC:\Windows\System32\alg.exeexecutable
MD5:558D5345CD0F9BFBE77ADD24E2721B1A
SHA256:F16BC053107B319FBD337BF76F8084053A29BB3A47C78F9FA272447CBA31BFB2
6492FlashPlayerUpdateService.exeC:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:42C1F97E42DF09B99F04FD310141C430
SHA256:7EB9935F43C4C68F700A9EA58407F101D25C67F4C9C2C47320CEEF3D18B17CEA
6652MicrosoftEdgeUpdate.exeC:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logtext
MD5:1E8D3037AC72A2F4762A056B2CBC7470
SHA256:820D8CB9287DFA57601745818966693642F40C2932319232A7D44FFA267BA6CB
6428Setup1.exeC:\Program Files\Google\Chrome\Application\122.0.6261.70\elevation_service.exeexecutable
MD5:99B87AF16D68407FB14E8952A8208268
SHA256:38759404E5A771320C7C1338B78148A3BD61C3373BCB64DB75789D826D130E2E
7120GameInputSvc.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FEbinary
MD5:6B306039D9EF8DCBF2F488269E6DECA1
SHA256:BCECF6601855462FFA023224B12001CDD317E1DBF738BA3DC28D8BCC944B9E14
6428Setup1.exeC:\Windows\System32\GameInputSvc.exeexecutable
MD5:A59E55D256372660140906FCF6048650
SHA256:18C2529E928E2D88938FDC10C33EE33BD34D5075E7C43EA66BF61DC15CB69C52
6428Setup1.exeC:\Program Files (x86)\Google\Update\GoogleUpdate.exeexecutable
MD5:AEFF9CE563A3CB2A016448F06AA78549
SHA256:373A7CB1EB86509C3BC3AF55021739881C1EF35ACF13A583B49666EDF8593251
6428Setup1.exeC:\Windows\System32\AppVClient.exeexecutable
MD5:7A3B0796991041EDCA76FFF63CE45BA9
SHA256:C1A87C88DAF59681679B95CDD8D398668500B7AEA2B2EE5D7EB600E7EA23A05A
5552maintenanceservice.exeC:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.logtext
MD5:D769FD1F74620ECE40F6770DA9B7DAFB
SHA256:3C4397BFA2A1DF02E09789A400920C405850BB5A548C34B99A475C5BC11A9D8A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
343
TCP/UDP connections
57
DNS requests
42
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6528
alg.exe
POST
200
54.244.188.177:80
http://pywolwnvd.biz/aqyyxaerrxhep
unknown
—
—
unknown
6428
Setup1.exe
POST
200
54.244.188.177:80
http://cvgrf.biz/xgvdmb
unknown
—
—
unknown
6428
Setup1.exe
POST
200
18.141.10.107:80
http://ssbzmoy.biz/lfxniekyihsglwau
unknown
—
—
unknown
6528
alg.exe
POST
200
18.141.10.107:80
http://ssbzmoy.biz/wvq
unknown
—
—
unknown
6428
Setup1.exe
POST
—
172.234.222.143:80
http://przvgke.biz/lqppfmuu
unknown
—
—
unknown
6864
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/01a02d0e-9d8d-47a3-8c36-9bf38dabe21a?P1=1724074770&P2=404&P3=2&P4=FpZAp6Hf%2b1sfJGnn3wlDHl1KoLcw5U11H7clkSfPC4Vc6gFFx2J0fE3nz%2fh2aVxEAtIdMYi%2fYXeYYZqw30hjXg%3d%3d
unknown
—
—
whitelisted
6528
alg.exe
POST
200
54.244.188.177:80
http://cvgrf.biz/ahamk
unknown
—
—
unknown
6864
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/01a02d0e-9d8d-47a3-8c36-9bf38dabe21a?P1=1724074770&P2=404&P3=2&P4=FpZAp6Hf%2b1sfJGnn3wlDHl1KoLcw5U11H7clkSfPC4Vc6gFFx2J0fE3nz%2fh2aVxEAtIdMYi%2fYXeYYZqw30hjXg%3d%3d
unknown
—
—
whitelisted
6528
alg.exe
POST
200
44.221.84.105:80
http://npukfztj.biz/bwbxn
unknown
—
—
unknown
6864
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/01a02d0e-9d8d-47a3-8c36-9bf38dabe21a?P1=1724074770&P2=404&P3=2&P4=FpZAp6Hf%2b1sfJGnn3wlDHl1KoLcw5U11H7clkSfPC4Vc6gFFx2J0fE3nz%2fh2aVxEAtIdMYi%2fYXeYYZqw30hjXg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3376
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4936
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6428
Setup1.exe
54.244.188.177:80
pywolwnvd.biz
AMAZON-02
US
unknown
—
—
54.244.188.177:80
pywolwnvd.biz
AMAZON-02
US
unknown
6428
Setup1.exe
18.141.10.107:80
ssbzmoy.biz
AMAZON-02
SG
unknown
—
—
18.141.10.107:80
ssbzmoy.biz
AMAZON-02
SG
unknown
6380
GoogleUpdate.exe
142.250.186.46:443
clients2.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
pywolwnvd.biz
  • 54.244.188.177
unknown
ssbzmoy.biz
  • 18.141.10.107
unknown
clients2.google.com
  • 142.250.186.46
whitelisted
cvgrf.biz
  • 54.244.188.177
malicious
npukfztj.biz
  • 44.221.84.105
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 13.95.26.4
whitelisted
przvgke.biz
  • 172.234.222.143
  • 172.234.222.138
unknown
geo.prod.do.dsp.mp.microsoft.com
  • 40.69.74.80
whitelisted

Threats

PID
Process
Class
Message
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6428
Setup1.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
—
—
A Network Trojan was detected
ET MALWARE DNS Query to DarkGate/Expiro Related Domain (knjghuig .biz)
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup1.exe