File name:

EAappInstaller.exe

Full analysis: https://app.any.run/tasks/a78d80a9-c355-4f57-9d62-d78c0ba9c2d6
Verdict: Malicious activity
Analysis date: March 24, 2025, 17:56:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

2FB5BB3062268AA54FDFE5372A191465

SHA1:

4152066B2127D475398F99DCBB8272EB7ACA5B6A

SHA256:

0EECB0DABC69CD0C27BAA59A04E585CB6B71846A910B97E2D111A218FCE7F136

SSDEEP:

49152:zLN9SgkHLWqnivnuhHqvVYSCh6ymc/msdzZ+n5PY23PPZLl0QuwcZr5FrcNsO6N1:zLbkHLWqniKHqvCmc+sdzEn5r3P1GHwy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • Setup.exe (PID: 7812)
      • vc_redist-11.0.61030.x86.exe (PID: 2064)
      • vc_redist-11.0.61030.x86.exe (PID: 8072)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 7376)
      • EAappInstaller.exe (PID: 3884)
      • EAappInstaller.exe (PID: 4380)
      • rundll32.exe (PID: 672)
      • rundll32.exe (PID: 7000)
      • rundll32.exe (PID: 8184)
      • rundll32.exe (PID: 8132)
      • EAappInstaller.exe (PID: 5256)
      • rundll32.exe (PID: 1764)
      • rundll32.exe (PID: 6272)
      • rundll32.exe (PID: 6584)
      • rundll32.exe (PID: 2288)
      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • EABackgroundService.exe (PID: 4740)
      • vc_redist-11.0.61030.x86.exe (PID: 8072)

    • Starts itself from another location

      • EAappInstaller.exe (PID: 7376)
      • EAappInstaller.exe (PID: 3884)
      • EAappInstaller.exe (PID: 4380)

    • Reads security settings of Internet Explorer

      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 4380)
      • EADesktop.exe (PID: 5600)

    • Reads Microsoft Outlook installation path

      • EAappInstaller.exe (PID: 4380)

    • Reads Internet Explorer settings

      • EAappInstaller.exe (PID: 4380)

    • Searches for installed software

      • EAappInstaller.exe (PID: 4380)

    • Creates a software uninstall entry

      • EAappInstaller.exe (PID: 5256)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2240)
      • EABackgroundService.exe (PID: 4740)
      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • vc_redist-11.0.61030.x86.exe (PID: 8072)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 2240)

    • Executes as Windows Service

      • EABackgroundService.exe (PID: 4740)
      • VSSVC.exe (PID: 7188)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 2240)
      • vc_redist-10.0.40219.x86.exe (PID: 5384)

    • Detected use of alternative data streams (AltDS)

      • EADesktop.exe (PID: 5600)

    • Creates file in the systems drive root

      • vc_redist-10.0.40219.x86.exe (PID: 5384)

    • Application launched itself

      • vc_redist-11.0.61030.x86.exe (PID: 2064)

  • INFO

    • Checks supported languages

      • EAappInstaller.exe (PID: 7376)
      • EAappInstaller.exe (PID: 3884)
      • EAappInstaller.exe (PID: 4380)
      • EAappInstaller.exe (PID: 5256)
      • msiexec.exe (PID: 2240)
      • msiexec.exe (PID: 4188)
      • msiexec.exe (PID: 7924)
      • Setup.exe (PID: 7812)

    • Create files in a temporary directory

      • EAappInstaller.exe (PID: 7376)
      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 3884)
      • EAappInstaller.exe (PID: 5256)
      • EAappInstaller.exe (PID: 4380)
      • EADesktop.exe (PID: 5600)

    • The sample compiled with english language support

      • EAappInstaller.exe (PID: 7376)
      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 3884)
      • EAappInstaller.exe (PID: 4380)
      • EAappInstaller.exe (PID: 5256)
      • msiexec.exe (PID: 2240)
      • EABackgroundService.exe (PID: 4740)
      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • vc_redist-11.0.61030.x86.exe (PID: 8072)

    • Reads the computer name

      • EAappInstaller.exe (PID: 4380)
      • msiexec.exe (PID: 2240)
      • msiexec.exe (PID: 4188)
      • EAappInstaller.exe (PID: 5256)
      • EABackgroundService.exe (PID: 4740)

    • Reads the machine GUID from the registry

      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 4380)
      • msiexec.exe (PID: 2240)
      • EABackgroundService.exe (PID: 4740)
      • EADesktop.exe (PID: 5600)

    • Checks proxy server information

      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 4380)

    • Creates files or folders in the user directory

      • EAappInstaller.exe (PID: 7400)
      • EAappInstaller.exe (PID: 4380)
      • EALocalHostSvc.exe (PID: 5020)
      • EALauncher.exe (PID: 2800)
      • EADesktop.exe (PID: 5600)
      • EACefSubProcess.exe (PID: 6516)

    • Reads the software policy settings

      • EAappInstaller.exe (PID: 7400)
      • msiexec.exe (PID: 2240)
      • EAappInstaller.exe (PID: 4380)
      • EABackgroundService.exe (PID: 4740)

    • Process checks whether UAC notifications are on

      • EAappInstaller.exe (PID: 4380)

    • Process checks computer location settings

      • EAappInstaller.exe (PID: 4380)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2240)

    • Creates files in the program directory

      • EAappInstaller.exe (PID: 5256)
      • rundll32.exe (PID: 1764)
      • EABackgroundService.exe (PID: 4740)
      • rundll32.exe (PID: 6584)
      • Setup.exe (PID: 7812)
      • vc_redist-11.0.61030.x86.exe (PID: 8072)

    • The sample compiled with japanese language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • The sample compiled with korean language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • The sample compiled with chinese language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • The sample compiled with Italian language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • Manual execution by a user

      • EADesktop.exe (PID: 5600)

    • The sample compiled with german language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • The sample compiled with spanish language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • The sample compiled with russian language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)

    • The sample compiled with french language support

      • vc_redist-10.0.40219.x86.exe (PID: 5384)
      • msiexec.exe (PID: 2240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:17 05:33:38+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 299008
InitializedDataSize: 266752
UninitializedDataSize: -
EntryPoint: 0x2df71
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.115.0.5372
ProductVersionNumber: 12.115.0.5372
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Electronic Arts
FileDescription: EA app
FileVersion: 12.115.0.5372
InternalName: setup
LegalCopyright: Copyright (c) Electronic Arts. All rights reserved.
OriginalFileName: EAappInstaller.exe
ProductName: EA app
ProductVersion: 12.115.0.5372
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
35
Malicious processes
9
Suspicious processes
4

Behavior graph

Click at the process to see the details
start eaappinstaller.exe eaappinstaller.exe sppextcomobj.exe no specs slui.exe eaappinstaller.exe eaappinstaller.exe eaappinstaller.exe slui.exe msiexec.exe msiexec.exe no specs rundll32.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe eabackgroundservice.exe rundll32.exe originlegacycli.exe no specs rundll32.exe ealauncher.exe no specs eadesktop.exe eacefsubprocess.exe no specs eacefsubprocess.exe ealocalhostsvc.exe vc_redist-10.0.40219.x86.exe setup.exe eacefsubprocess.exe no specs eacefsubprocess.exe no specs eacefsubprocess.exe no specs vc_redist-11.0.61030.x86.exe no specs vc_redist-11.0.61030.x86.exe SPPSurrogate no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672rundll32.exe "C:\WINDOWS\Installer\MSICE9B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1167031 12 juno-custom-actions!JunoCustomActions.JunoCustomActions.InitializeSessionC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
732"C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe" --type=gpu-process --no-sandbox --log-severity=warning --user-agent-product="Origin/10.6.0.00000 EAApp/13.423.0.5936 Chrome/109.0.5414.120" --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\Electronic Arts\EA Desktop\CEF" --enable-smooth-scrolling --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\admin\AppData\Local\Electronic Arts\EA Desktop\Logs\cef.log" --mojo-platform-channel-handle=2944 --field-trial-handle=2988,i,9721558536957328171,14261837841869201117,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EACefSubProcess.exe—EADesktop.exe
User:
admin
Company:
Electronic Arts
Integrity Level:
MEDIUM
Description:
EA
Version:
13, 423, 0, 5936
Modules
Images
c:\program files\electronic arts\ea desktop\ea desktop\eacefsubprocess.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\electronic arts\ea desktop\ea desktop\msvcp140.dll
c:\program files\electronic arts\ea desktop\ea desktop\vcruntime140.dll
c:\program files\electronic arts\ea desktop\ea desktop\libcef.dll
c:\program files\electronic arts\ea desktop\ea desktop\vcruntime140_1.dll
736C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
904C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1764rundll32.exe "C:\WINDOWS\Installer\MSIE1D8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1171953 30 juno-custom-actions!JunoCustomActions.JunoCustomActions.CreateAdminWritableDirectoriesC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2064"C:\Program Files\Electronic Arts\EA Desktop\VC\vc_redist-11.0.61030.x86.exe" /install /quiet /norestart /log "C:\ProgramData\EA Desktop\Logs\vc_redist-11.0.61030.x86.exe.log"C:\Program Files\Electronic Arts\EA Desktop\VC\vc_redist-11.0.61030.x86.exe—EABackgroundService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
Version:
11.0.61030.0
Modules
Images
c:\program files\electronic arts\ea desktop\vc\vc_redist-11.0.61030.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2240C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2288rundll32.exe "C:\WINDOWS\Installer\MSI832C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1213281 63 juno-custom-actions!JunoCustomActions.JunoCustomActions.LaunchClientC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2800"C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe" C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe—rundll32.exe
User:
admin
Company:
Electronic Arts
Integrity Level:
HIGH
Description:
EA
Exit code:
0
Version:
13, 423, 0, 5936
Modules
Images
c:\program files\electronic arts\ea desktop\ea desktop\ealauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\program files\electronic arts\ea desktop\ea desktop\msvcp140.dll
c:\windows\system32\user32.dll
2908"C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginLegacyCLI.exe" -registerC:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginLegacyCLI.exe—EABackgroundService.exe
User:
SYSTEM
Company:
Electronic Arts
Integrity Level:
SYSTEM
Description:
OriginLegacyCLI
Exit code:
1
Version:
8,1,1,1591
Modules
Images
c:\program files\electronic arts\ea desktop\ea desktop\legacypm\originlegacycli.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
52 384
Read events
50 568
Write events
1 766
Delete events
50

Modification events

(PID) Process:(4380) EAappInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4380) EAappInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4380) EAappInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:BundleCachePath
Value:
C:\ProgramData\Package Cache\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}\EAappInstaller.exe
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:BundleUpgradeCode
Value:
{ADF2591E-00D2-4FFF-9BF4-9CCDAE6BDC67}
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:BundleAddonCode
Value:
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:BundleDetectCode
Value:
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:BundlePatchCode
Value:
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:BundleVersion
Value:
13.423.0.5936
(PID) Process:(5256) EAappInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5d7078a4-7c9e-4ade-85bf-61c3856006ac}
Operation:writeName:VersionMajor
Value:
13
Executable files
279
Suspicious files
387
Text files
673
Unknown types
0

Dropped files

PID
Process
Filename
Type
7376EAappInstaller.exeC:\Users\admin\AppData\Local\Temp\{5973E0BC-0E1C-4597-B168-CD77E15FC251}\.cr\EAappInstaller.exeexecutable
MD5:2FB5BB3062268AA54FDFE5372A191465
SHA256:0EECB0DABC69CD0C27BAA59A04E585CB6B71846A910B97E2D111A218FCE7F136
7400EAappInstaller.exeC:\Users\admin\AppData\Local\Temp\{5FB57E89-7B21-421A-96BB-4821C05E23B5}\.ba\juno-bootstrapper-application.dllbinary
MD5:CC0312C685642CB8E1A038C645EFCE8D
SHA256:9C5EEC705F1C958127A027DC31B06242A5714B1A136A30A48A03B5D56ED6C39E
7400EAappInstaller.exeC:\Users\admin\AppData\Local\Temp\{5FB57E89-7B21-421A-96BB-4821C05E23B5}\.ba\version.dllexecutable
MD5:E2EC4D53E85282276F93DB5026CB40D2
SHA256:A68A2ADED6A2D2A3CC76C8580E726AB888DFB67BFB73966296A1B199B7D1A43D
7400EAappInstaller.exeC:\Users\admin\AppData\Local\Temp\{5FB57E89-7B21-421A-96BB-4821C05E23B5}\.be\EAappInstaller.exeexecutable
MD5:2FB5BB3062268AA54FDFE5372A191465
SHA256:0EECB0DABC69CD0C27BAA59A04E585CB6B71846A910B97E2D111A218FCE7F136
7400EAappInstaller.exeC:\Users\admin\AppData\Local\Temp\{5FB57E89-7B21-421A-96BB-4821C05E23B5}\.ba\BootstrapperApplicationData.xmlbinary
MD5:0EBFEB5D7036A4760D09409CDC752299
SHA256:331EC4A01EDC8DDFB62126F21E42FB012282CA483287E5C501E605A683CDC0B1
7400EAappInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:9D4E976D5EF164D4385E87BCC5D617CE
SHA256:C90172DC217A0086AFFD7A6294FC91A2ECE0D87271E5476C4465776B9A5258C3
7400EAappInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:7D5F6AC28A8D523BFB00034688D4AED6
SHA256:4A396FDEBDEB10FCB25F7C9AA26306588B332CC30EBAD664D2064145BBE19019
7400EAappInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\48[1].jsonbinary
MD5:6F05A7646023D86038C6079062A2E04E
SHA256:57CAD66036F153BA3AF2D8AD56CC76E44F76680210FD1B111C002C703D481F48
7400EAappInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:C3B2E7057647C482D82920D6B089D0C2
SHA256:74442205B68F9C71A9D4EB83EF34D32F31578339E2054DE44F6CFC234C60167D
7400EAappInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:23FC888B1FE1C3B977016A26582E7184
SHA256:C6D47FC96BD8DF11F4BE3922B13D6D67D97ACFD64DBF5F36FAC94B649E8DDFE4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
68
DNS requests
47
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
unknown
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAmkqApTkBtUHrze5ePBmqo%3D
unknown
—
—
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
7908
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
4380
EAappInstaller.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
unknown
4380
EAappInstaller.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
unknown
4380
EAappInstaller.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAZxNS3EwQO3Cucl6VRIY3Q%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5496
MoUsoCoreWorker.exe
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
—
—
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
5496
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
23.60.203.16:443
autopatch.juno.ea.com
AKAMAI-AS
DE
unknown
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
—
—
23.196.246.72:443
ratt.juno.ea.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
unknown
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
  • 23.53.40.178
  • 23.53.40.176
unknown
autopatch.juno.ea.com
  • 23.60.203.16
  • 23.212.221.189
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
ratt.juno.ea.com
  • 23.196.246.72
  • 23.212.221.189
unknown
pin-river.data.ea.com
  • 3.210.163.56
  • 34.198.150.46
  • 34.226.59.158
  • 54.165.104.125
  • 52.73.152.216
  • 52.7.9.24
  • 35.169.133.181
  • 52.21.193.15
  • 34.228.209.168
  • 100.24.157.23
  • 44.209.46.9
  • 44.217.166.244
  • 98.82.209.98
  • 75.101.182.105
  • 44.209.72.206
  • 54.210.7.143
  • 54.157.29.87
  • 54.81.10.43
unknown
origin-a.akamaihd.net
  • 2.22.242.81
  • 2.22.242.123
  • 2.16.168.101
  • 2.16.168.121
  • 23.53.40.65
  • 23.53.40.66
  • 23.53.40.82
  • 23.53.40.8
  • 23.53.40.10
  • 23.53.40.64
  • 23.53.40.40
  • 23.53.40.25
unknown
login.live.com
  • 20.190.160.17
  • 20.190.160.3
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.4
  • 20.190.160.66
  • 40.126.32.138
  • 40.126.32.134
unknown
client.wns.windows.com
  • 40.113.110.67
unknown
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
unknown

Threats

No threats detected
Process
Message
Setup.exe
The operation completed successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EAappInstaller.exe