File name:

WebComponents.exe

Full analysis: https://app.any.run/tasks/32801a8d-da0b-4a7d-a097-4df0e96c9b31
Verdict: Malicious activity
Analysis date: May 16, 2025, 16:02:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

89CB83101CDE8B7E3FED2A92EEDC0277

SHA1:

9263DDFD763A65CB7BD65E25AB312C5FDA8E0510

SHA256:

04FEC22CA61C657F6F46160E55334E3DEFEEA0E193BC8EC6D7BB45C87E773361

SSDEEP:

49152:17plcgwwFBkZwAJl4GtZzhwxAv5mrxD0D7Mo4AgYrjBBqDAtw24kk8pgMh0e7f61:1plpWZwAJ+hxAhSxD0HrgY/qDAtw2mrJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • WebComponents.exe (PID: 7312)
      • WebComponents.exe (PID: 7468)

    • Registers / Runs the DLL via REGSVR32.EXE

      • WebComponents.tmp (PID: 7492)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WebComponents.tmp (PID: 7332)

    • Executable content was dropped or overwritten

      • WebComponents.exe (PID: 7468)
      • WebComponents.tmp (PID: 7492)
      • WebComponents.exe (PID: 7312)

    • Reads the Windows owner or organization settings

      • WebComponents.tmp (PID: 7492)

    • Process drops legitimate windows executable

      • WebComponents.tmp (PID: 7492)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 7924)

  • INFO

    • Create files in a temporary directory

      • WebComponents.exe (PID: 7312)
      • WebComponents.exe (PID: 7468)
      • WebComponents.tmp (PID: 7492)

    • Checks supported languages

      • WebComponents.exe (PID: 7312)
      • WebComponents.tmp (PID: 7332)
      • WebComponents.exe (PID: 7468)
      • WebComponents.tmp (PID: 7492)

    • The sample compiled with chinese language support

      • WebComponents.exe (PID: 7312)
      • WebComponents.exe (PID: 7468)
      • WebComponents.tmp (PID: 7492)

    • Reads the computer name

      • WebComponents.tmp (PID: 7332)
      • WebComponents.tmp (PID: 7492)

    • Process checks computer location settings

      • WebComponents.tmp (PID: 7332)

    • Creates files in the program directory

      • WebComponents.tmp (PID: 7492)

    • The sample compiled with english language support

      • WebComponents.tmp (PID: 7492)

    • Creates a software uninstall entry

      • WebComponents.tmp (PID: 7492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37376
InitializedDataSize: 13312
UninitializedDataSize: -
EntryPoint: 0x9978
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.4.6
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: ASCII
Comments: 此安装程序由 Inno Setup 构建。
CompanyName:
FileDescription: Web Components Setup
FileVersion: 3.0.4.6
LegalCopyright:
ProductName: Web Components
ProductVersion: 3.0.4.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start webcomponents.exe webcomponents.tmp no specs webcomponents.exe webcomponents.tmp sppextcomobj.exe no specs slui.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7312"C:\Users\admin\Desktop\WebComponents.exe" C:\Users\admin\Desktop\WebComponents.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Web Components Setup
Exit code:
0
Version:
3.0.4.6
Modules
Images
c:\users\admin\desktop\webcomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7332"C:\Users\admin\AppData\Local\Temp\is-RBECD.tmp\WebComponents.tmp" /SL5="$802C6,1134702,51712,C:\Users\admin\Desktop\WebComponents.exe" C:\Users\admin\AppData\Local\Temp\is-RBECD.tmp\WebComponents.tmp—WebComponents.exe
User:
admin
Integrity Level:
MEDIUM
Description:
安装/卸载
Exit code:
0
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-rbecd.tmp\webcomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7468"C:\Users\admin\Desktop\WebComponents.exe" /SPAWNWND=$702B0 /NOTIFYWND=$802C6 C:\Users\admin\Desktop\WebComponents.exe
WebComponents.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Web Components Setup
Exit code:
0
Version:
3.0.4.6
Modules
Images
c:\users\admin\desktop\webcomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7492"C:\Users\admin\AppData\Local\Temp\is-PACC2.tmp\WebComponents.tmp" /SL5="$60294,1134702,51712,C:\Users\admin\Desktop\WebComponents.exe" /SPAWNWND=$702B0 /NOTIFYWND=$802C6 C:\Users\admin\AppData\Local\Temp\is-PACC2.tmp\WebComponents.tmp
WebComponents.exe
User:
admin
Integrity Level:
HIGH
Description:
安装/卸载
Exit code:
0
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-pacc2.tmp\webcomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7528C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7560"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7924"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\Web Components\WebVideoActiveX.ocx"C:\Windows\SysWOW64\regsvr32.exe—WebComponents.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
806
Read events
789
Write events
17
Delete events
0

Modification events

(PID) Process:(7492) WebComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\MozillaPlugins\Web Components
Operation:writeName:Path
Value:
C:\Program Files (x86)\Web Components\npWebVideoPlugin.dll
(PID) Process:(7924) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE8B9108-0847-49C1-8E58-5972B6137DFD}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7924) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DE8B9108-0847-49C1-8E58-5972B6137DFD}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7924) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F79CD87-2D7A-4086-807E-D5E1A3E37BE5}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7924) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F79CD87-2D7A-4086-807E-D5E1A3E37BE5}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7924) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7EF736D-B4E6-4A5A-BA94-732D71107808}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(7492) WebComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.2.3
(PID) Process:(7492) WebComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\Web Components
(PID) Process:(7492) WebComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Web Components\
(PID) Process:(7492) WebComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WebComponents
Executable files
19
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7468WebComponents.exeC:\Users\admin\AppData\Local\Temp\is-PACC2.tmp\WebComponents.tmpexecutable
MD5:ADBBCF3057B0BA83F1DFEFFF18D0B116
SHA256:D6E6BB562616B544BF7CF5F4AB515A6189B5ABDB29AE91A8C9189841CA8A7A47
7312WebComponents.exeC:\Users\admin\AppData\Local\Temp\is-RBECD.tmp\WebComponents.tmpexecutable
MD5:ADBBCF3057B0BA83F1DFEFFF18D0B116
SHA256:D6E6BB562616B544BF7CF5F4AB515A6189B5ABDB29AE91A8C9189841CA8A7A47
7492WebComponents.tmpC:\Users\admin\AppData\Local\Temp\is-K7CIR.tmp\_isetup\_setup64.tmpexecutable
MD5:B4604F8CD050D7933012AE4AA98E1796
SHA256:B50B7AC03EC6DA865BF4504C7AC1E52D9F5B67C7BCB3EC0DB59FAB24F1B471C5
7492WebComponents.tmpC:\Program Files (x86)\Web Components\StreamTransClient.dllexecutable
MD5:9C815BEDDFB088A6E1B96A230AFA18E5
SHA256:05950A0FEBECEEC1503711630FF6CDBD370F310E23A0D7342A8E6BE921882025
7492WebComponents.tmpC:\Program Files (x86)\Web Components\PlayCtrl.dllexecutable
MD5:0E8E7214B5E8F471E697E60958D41004
SHA256:72B07BF7C4EBEA72F5585420BD33330BA4C7AABBAFA7BC364FB2736C3896E554
7492WebComponents.tmpC:\Program Files (x86)\Web Components\is-Q40LD.tmpexecutable
MD5:25F74B782820410DA4C031E4E9157DE9
SHA256:3779D4E42F499D60B246295C1A0A0C2D5ABB2BEC099AA3050C79947E0FDDB3A5
7492WebComponents.tmpC:\Program Files (x86)\Web Components\is-BALH3.tmpexecutable
MD5:BB81A2E4C420E314B0EC6B4C8736FB48
SHA256:829B5F4577EFB793E5F89859213E2C04E2A137F551AB31DF25161647C1403D2B
7492WebComponents.tmpC:\Program Files (x86)\Web Components\unins000.exeexecutable
MD5:B884885E83A01639C71B399921A5D551
SHA256:A79B1D3C3BD899AC916483F9C6228E9D116BE18575FB0FD1FA480CD5660C3521
7492WebComponents.tmpC:\Program Files (x86)\Web Components\NetStream.dllexecutable
MD5:BB81A2E4C420E314B0EC6B4C8736FB48
SHA256:829B5F4577EFB793E5F89859213E2C04E2A137F551AB31DF25161647C1403D2B
7492WebComponents.tmpC:\Users\admin\AppData\Local\Temp\is-K7CIR.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6404
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.5
  • 20.190.160.64
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.65
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WebComponents.exe