File name:

Gmod Content Installer.exe

Full analysis: https://app.any.run/tasks/04ec6c07-89f3-4f77-9448-2c35312b912c
Verdict: Malicious activity
Analysis date: May 12, 2025, 03:28:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

4C9FE23A0E93E2A2DDEEDD40237C7A6D

SHA1:

28CFCA88E559061F4065F96A3645EC6059E69E44

SHA256:

0A6A090ABC379ED5DA6D5355C55553C4D9A91869651BFD5F50B405129FF26394

SSDEEP:

98304:y/0Ceab/6ruQR2omUxipmYwDmuqOV6Eus6Vg9XLDb0tnkuA83wpYp2tw9o/U+FGG:C0vDoN4ecvsA49m9ft5xUqe5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • Gmod Content Installer.exe (PID: 5164)

    • Process drops python dynamic module

      • Gmod Content Installer.exe (PID: 5164)

    • Process drops legitimate windows executable

      • Gmod Content Installer.exe (PID: 5164)

    • Executable content was dropped or overwritten

      • Gmod Content Installer.exe (PID: 5164)

    • The process drops C-runtime libraries

      • Gmod Content Installer.exe (PID: 5164)

  • INFO

    • Reads the computer name

      • Gmod Content Installer.exe (PID: 5164)

    • The sample compiled with english language support

      • Gmod Content Installer.exe (PID: 5164)

    • Checks supported languages

      • Gmod Content Installer.exe (PID: 2088)
      • Gmod Content Installer.exe (PID: 5164)

    • PyInstaller has been detected (YARA)

      • Gmod Content Installer.exe (PID: 5164)

    • Create files in a temporary directory

      • Gmod Content Installer.exe (PID: 5164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:12 03:26:37+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 178688
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gmod content installer.exe conhost.exe no specs gmod content installer.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Gmod Content Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Users\admin\AppData\Local\Temp\Gmod Content Installer.exe" C:\Users\admin\AppData\Local\Temp\Gmod Content Installer.exe—Gmod Content Installer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\gmod content installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5164"C:\Users\admin\AppData\Local\Temp\Gmod Content Installer.exe" C:\Users\admin\AppData\Local\Temp\Gmod Content Installer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\gmod content installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
291
Read events
291
Write events
0
Delete events
0

Modification events

No data
Executable files
65
Suspicious files
1
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\VCRUNTIME140_1.dllexecutable
MD5:C0C0B4C611561F94798B62EB43097722
SHA256:497A280550443E3E9F89E428E51CB795139CA8944D5DEDD54A7083C00E7164E5
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_bz2.pydexecutable
MD5:1E9F539F6A540DBE4835523A4E6E0628
SHA256:7BB68942BA5062BA662CFE5FE39ED96196D3EA2A64D8807BD2DC29106BA5D044
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\VCRUNTIME140.dllexecutable
MD5:32DA96115C9D783A0769312C0482A62D
SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_asyncio.pydexecutable
MD5:042041201574C87AAA396357CEE23BFF
SHA256:A4D40514A9A07BD4A87C485CA7D15ED8B2AB7D48B077545527B1DD5D5E91DB56
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_ssl.pydexecutable
MD5:F8DE2F47435CC4130BE2C7554FB5E2D1
SHA256:12378878CB3F687A43B459C7416AB3436DF8BAE43833ED61095D74A0D8B13557
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:8F8EB9CB9E78E3A611BC8ACAEC4399CB
SHA256:1BD81DFD19204B44662510D9054852FB77C9F25C1088D647881C9B976CC16818
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_wmi.pydexecutable
MD5:CD92B8DB1CCA00EABA78A7FA10DFA786
SHA256:BEECA5AB2FFDA6DD11ECF57BA8D4FB40A80C95B781331E380AE8197344BAA070
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_multiprocessing.pydexecutable
MD5:7D565AF1768368A07F2E10BC6E6295EE
SHA256:120E15F67A5FF41AB147C05BE447EC8303C064DB6EBD56197865EC86E41EE0F3
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:C2F8C03ECCE9941492BFBE4B82F7D2D5
SHA256:D56CE7B1CD76108AD6C137326EC694A14C99D48C3D7B0ACE8C3FF4D9BCEE3CE8
5164Gmod Content Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\api-ms-win-core-fibers-l1-1-0.dllexecutable
MD5:B5E2760C5A46DBEB8AE18C75F335707E
SHA256:91D249D7BC0E38EF6BCB17158B1FDC6DD8888DC086615C9B8B750B87E52A5FB3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6988
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6988
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.129
  • 20.190.159.131
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.75
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gmod Content Installer.exe