File name:

Setup_Bosch_Passthru_v2.30.1(1).exe

Full analysis: https://app.any.run/tasks/ae9b1e24-2531-4da7-90ba-f4d890158927
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 03, 2024, 10:29:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

64237AF2942282A3AE7F33E5CD4654A8

SHA1:

BB29C3F36DE1004EF0620E88466C2E68F33CD445

SHA256:

053BDC202B63581662BA8F4DA24AD9F78FFF7E8780FFB343E8B4F54A8C4AB15F

SSDEEP:

98304:a0oxUyuU1eYluOc+Wp5D84wRqOMxVw0lvQsslBWavIGbdVKjgkWBmYjuuCDY2FgK:Wt1HHfc47GOw6QSMzfx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • RbSer32Setup.tmp (PID: 2640)
      • msiexec.exe (PID: 2752)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Create files in the Startup directory

      • msiexec.exe (PID: 2752)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • MigrationSetup.tmp (PID: 2440)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 2752)
      • KTSNG-Setup.tmp (PID: 664)

    • Reads the Internet Settings

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • RbSer32Setup.tmp (PID: 2640)
      • msiexec.exe (PID: 3112)

    • Drops a system driver (possible attempt to evade defenses)

      • RbSer32Setup.tmp (PID: 2640)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)
      • KTSNG-Setup.tmp (PID: 664)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 2484)
      • cscript.exe (PID: 2436)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 2484)
      • cscript.exe (PID: 2436)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)

    • The process executes VB scripts

      • DDCSetup.tmp (PID: 452)

    • Starts SC.EXE for service management

      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3112)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Uses powercfg.exe to modify the power settings

      • KTSNG-Setup.tmp (PID: 664)

  • INFO

    • Drops the executable file immediately after the start

      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 2036)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 532)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • Setup_Bosch_Passthru_v2.30.1_dat.exe (PID: 1740)
      • MigrationSetup.exe (PID: 2336)
      • RbSer32Setup.exe (PID: 2628)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.tmp (PID: 452)
      • DDCSetup.exe (PID: 2592)
      • RbSer32Setup.tmp (PID: 2640)
      • msiexec.exe (PID: 3112)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2752)
      • KTSNG-Setup.tmp (PID: 664)
      • KTSNG-Setup.exe (PID: 2560)

    • Checks supported languages

      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 2036)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 1404)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 532)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • Setup_Bosch_Passthru_v2.30.1_dat.exe (PID: 1740)
      • MigrationSetup.exe (PID: 2336)
      • MigrationSetup.tmp (PID: 2440)
      • RbSer32Setup.exe (PID: 2628)
      • RBSer32.exe (PID: 2644)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.exe (PID: 2592)
      • DDCSetup.tmp (PID: 452)
      • RBSer32.exe (PID: 2692)
      • UsbPwrCtrl.exe (PID: 2404)
      • msiexec.exe (PID: 2752)
      • msiexec.exe (PID: 3112)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2072)
      • DPInst-x32.exe (PID: 1496)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)
      • vci-ident.exe (PID: 1656)
      • KTSNG-Setup.tmp (PID: 664)
      • KTSNG-Setup.exe (PID: 2560)
      • RBSer32.exe (PID: 3244)
      • RbStartProg.exe (PID: 3168)
      • RbStartProg.exe (PID: 3248)
      • PtUpdateCheck.exe (PID: 3252)
      • RBsys.exe (PID: 3264)

    • Reads the computer name

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 1404)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • MigrationSetup.tmp (PID: 2440)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.tmp (PID: 452)
      • UsbPwrCtrl.exe (PID: 2404)
      • msiexec.exe (PID: 2752)
      • msiexec.exe (PID: 3112)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2072)
      • drvinst.exe (PID: 3888)
      • DPInst-x32.exe (PID: 1496)
      • drvinst.exe (PID: 3744)
      • vci-ident.exe (PID: 1656)
      • RBSer32.exe (PID: 3244)
      • KTSNG-Setup.tmp (PID: 664)
      • RBsys.exe (PID: 3264)

    • Create files in a temporary directory

      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 2036)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 532)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • Setup_Bosch_Passthru_v2.30.1_dat.exe (PID: 1740)
      • MigrationSetup.exe (PID: 2336)
      • MigrationSetup.tmp (PID: 2440)
      • RbSer32Setup.exe (PID: 2628)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.exe (PID: 2592)
      • DDCSetup.tmp (PID: 452)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 3112)
      • msiexec.exe (PID: 2752)
      • DPInst-x32.exe (PID: 1496)
      • KTSNG-Setup.exe (PID: 2560)
      • KTSNG-Setup.tmp (PID: 664)

    • Checks proxy server information

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)

    • Reads the machine GUID from the registry

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • msiexec.exe (PID: 3112)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2752)
      • msiexec.exe (PID: 2072)
      • DPInst-x32.exe (PID: 1496)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Process requests binary or script from the Internet

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)

    • Drops 7-zip archiver for unpacking

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • KTSNG-Setup.tmp (PID: 664)

    • Creates files in the program directory

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • MigrationSetup.tmp (PID: 2440)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 2944)
      • vci-ident.exe (PID: 1656)
      • KTSNG-Setup.tmp (PID: 664)
      • RBsys.exe (PID: 3264)

    • Process drops legitimate windows executable

      • MigrationSetup.tmp (PID: 2440)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)
      • KTSNG-Setup.tmp (PID: 664)

    • The process drops C-runtime libraries

      • RbSer32Setup.tmp (PID: 2640)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2484)
      • cscript.exe (PID: 2436)

    • Executes as Windows Service

      • UsbPwrCtrl.exe (PID: 2404)
      • vci-ident.exe (PID: 1656)

    • Application launched itself

      • msiexec.exe (PID: 2752)

    • Reads Environment values

      • msiexec.exe (PID: 3112)

    • Manual execution by a user

      • RBsys.exe (PID: 3264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 15:27:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.30.1.0
ProductVersionNumber: 2.30.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Robert Bosch GmbH
FileDescription: Bosch Pass-Thru v2 Setup
FileVersion: 2.30.1
LegalCopyright: Copyright 2020 by Robert Bosch GmbH
ProductName: Bosch Pass-Thru v2 (KTS5a Series)
ProductVersion: 2.30.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
63
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
start setup_bosch_passthru_v2.30.1(1).exe no specs setup_bosch_passthru_v2.30.1(1).tmp no specs setup_bosch_passthru_v2.30.1(1).exe setup_bosch_passthru_v2.30.1(1).tmp setup_bosch_passthru_v2.30.1_dat.exe no specs migrationsetup.exe no specs migrationsetup.tmp no specs rbser32.exe no specs rbser32setup.exe no specs rbser32setup.tmp no specs rbser32.exe no specs ddcsetup.exe no specs ddcsetup.tmp no specs cscript.exe no specs sc.exe no specs sc.exe no specs usbpwrctrl.exe no specs cscript.exe no specs cscript.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs gvci-platform-setup.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs msiexec.exe no specs dpinst-x32.exe no specs drvinst.exe no specs drvinst.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs vci-ident.exe no specs ktsng-setup.exe no specs ktsng-setup.tmp no specs powercfg.exe no specs powercfg.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs rbstartprog.exe no specs rbstartprog.exe no specs ptupdatecheck.exe no specs rbsys.exe no specs rbser32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Users\admin\AppData\Local\Temp\is-DDKEB.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmp" /SL5="$501AC,5816348,121344,C:\Users\admin\AppData\Local\Temp\Setup_Bosch_Passthru_v2.30.1(1).exe" /SPAWNWND=$501B2 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\is-DDKEB.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmp
Setup_Bosch_Passthru_v2.30.1(1).exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ddkeb.tmp\setup_bosch_passthru_v2.30.1(1).tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
452"C:\Users\admin\AppData\Local\Temp\is-JQRR2.tmp\DDCSetup.tmp" /SL5="$501D2,10111846,119296,C:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\DDCSetup.exe" /SP- /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /Skip_BT_Setup /LANG=en /LOG="C:\Program Files\Bosch\Passthru_v2\DDCSetup.tmp"C:\Users\admin\AppData\Local\Temp\is-JQRR2.tmp\DDCSetup.tmp—DDCSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jqrr2.tmp\ddcsetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
532"C:\Users\admin\AppData\Local\Temp\Setup_Bosch_Passthru_v2.30.1(1).exe" /SPAWNWND=$501B2 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\Setup_Bosch_Passthru_v2.30.1(1).exe
Setup_Bosch_Passthru_v2.30.1(1).tmp
User:
admin
Company:
Robert Bosch GmbH
Integrity Level:
HIGH
Description:
Bosch Pass-Thru v2 Setup
Exit code:
0
Version:
2.30.1
Modules
Images
c:\users\admin\appdata\local\temp\setup_bosch_passthru_v2.30.1(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
552"powercfg" /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0C:\Windows\System32\powercfg.exe—KTSNG-Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
664"C:\Users\admin\AppData\Local\Temp\is-TKA4N.tmp\KTSNG-Setup.tmp" /SL5="$801D4,2042288,119296,C:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\KTSNG-Setup.exe" /VERYSILENT /LOG="C:\Program Files\Bosch\Passthru_v2\KTSNG-Setup.tmp"C:\Users\admin\AppData\Local\Temp\is-TKA4N.tmp\KTSNG-Setup.tmp—KTSNG-Setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-tka4n.tmp\ktsng-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
712netsh advfirewall firewall add rule dir=out action=allow enable=yes profile=any remoteip=any program="C:\Program Files\Bosch\VTX-VCI\VCI Software (KTS)\VCI Identification Service\vci-ident.exe" name="VCI Identification Service (KTS)"C:\Windows\System32\netsh.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
948"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bosch_DDC" program="C:\Program Files\Bosch\Diagnostics\RBSystem\RBsys.exe" dir=out action=allow profile=anyC:\Windows\System32\netsh.exe—DDCSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
996"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Bosch_ModuleConfiguratin_RemoteIp"C:\Windows\System32\netsh.exe—KTSNG-Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1192"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Bosch_esitronic2.0"C:\Windows\System32\netsh.exe—KTSNG-Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1232"C:\Windows\system32\cscript.exe" C:\Users\admin\AppData\Local\Temp\is-5IO5M.tmp\IsBTHActive.vbsC:\Windows\System32\cscript.exe—DDCSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
25 119
Read events
23 782
Write events
1 289
Delete events
48

Modification events

(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2440) MigrationSetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:Sequence
Value:
1
(PID) Process:(2440) MigrationSetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:SessionHash
Value:
05685D85CF83226FE5982C5ADCF236CBBCB111CD0D89A71B5ACFE53C9C9ABBB3
Executable files
345
Suspicious files
314
Text files
147
Unknown types
0

Dropped files

PID
Process
Filename
Type
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\Setup_Bosch_Passthru_v2.30.1_dat.exe —
MD5:—
SHA256:—
1740Setup_Bosch_Passthru_v2.30.1_dat.exeC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\GVCI-Platform-Setup.exe —
MD5:—
SHA256:—
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\uninstall\is-3E91F.tmp —
MD5:—
SHA256:—
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\uninstall\GVCI-Platform-Setup.exe —
MD5:—
SHA256:—
2036Setup_Bosch_Passthru_v2.30.1(1).exeC:\Users\admin\AppData\Local\Temp\is-6LA2T.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\is-8UPE4.tmppdf
MD5:338CC23D7445BBFD2C84CA9DF6F8F4AA
SHA256:3A30CE5B5DD7BE894F5DC95F4DA86FC8DF9ABDA1715712F0A1F0A7FEDBA9F094
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\DDCSetup.exeexecutable
MD5:55DF673AE4F2A6E04B037B3E64FBD228
SHA256:50DD0D4B5240F6438CEBDA54FE1040F9DBC7A895700F6015FB736372F954E999
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\is-E5M46.tmpexecutable
MD5:7470E269A4D4ABC1FE618086EE39B54C
SHA256:07B8BE6948E76CFE316697D4D00E1E28501BE861D3DD7B94041B6C9A632B6A97
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\RBSer32.exeexecutable
MD5:1F78D66C52BC25EC381A7366E6F95D82
SHA256:8E83FAF4E8F11F39F2D426497E49704ED107E114F15DC00D6D1AAB6BA2BFB043
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\idp.dllexecutable
MD5:9A83F220BF8CA569E3CFA654539A47A4
SHA256:B1C4C9B2DD6A40974FA8789B218B52D967F5CCD1B47E95B4F6BDA4B6CE864D0D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
HEAD
200
13.107.246.45:80
http://download.esitronic.de/KTSdownload/kts-setups/Setup_Bosch_Passthru_v2.30.1_dat.exe
unknown
—
—
unknown
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
GET
—
13.107.246.45:80
http://download.esitronic.de/KTSdownload/kts-setups/Setup_Bosch_Passthru_v2.30.1_dat.exe
unknown
—
—
unknown
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
GET
200
13.107.246.45:80
http://download.esitronic.de/KTSdownload/kts-setups/Setup_Bosch_Passthru_v2.30.1_dat.exe
unknown
executable
103 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
13.107.246.45:80
download.esitronic.de
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
download.esitronic.de
  • 13.107.246.45
  • 13.107.213.45
unknown

Threats

PID
Process
Class
Message
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_Bosch_Passthru_v2.30.1(1).exe