| File name: | MineyMap - Installer.exe |
| Full analysis: | https://app.any.run/tasks/9dc8703a-3ff9-4ea4-b6a7-f02af6bbc968 |
| Verdict: | Malicious activity |
| Analysis date: | July 25, 2025, 19:04:45 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
| MD5: | F42682BFC70F2790CEF4284341F66199 |
| SHA1: | BDDDFA0F81FDEC1D6E245214E90B1F68B2CF99A6 |
| SHA256: | 1B2F855F13E215F8A377A08C2F64550D07C2C3FC86A3EFA4BF1C7A8701E518F7 |
| SSDEEP: | 98304:8E/NjIL9yJ/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhBIHsCE+1mcMRwSMRwgF9i:gYAR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Malware-specific behavior (creating "System.dll" in Temp)
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
Reads security settings of Internet Explorer
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
- OWInstaller.exe (PID: 1100)
Application launched itself
- MineyMap - Installer.exe (PID: 3576)
Executable content was dropped or overwritten
- MineyMap - Installer.exe (PID: 4724)
- MineyMap - Installer.exe (PID: 3576)
The process creates files with name similar to system file names
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
Drops 7-zip archiver for unpacking
- MineyMap - Installer.exe (PID: 4724)
Reads Internet Explorer settings
- OWInstaller.exe (PID: 1100)
There is functionality for taking screenshot (YARA)
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
Reads the date of Windows installation
- OWInstaller.exe (PID: 1100)
Reads Microsoft Outlook installation path
- OWInstaller.exe (PID: 1100)
Creates/Modifies COM task schedule object
- dxdiag.exe (PID: 1976)
INFO
The sample compiled with english language support
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
Create files in a temporary directory
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
Reads the computer name
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
- OWInstaller.exe (PID: 1100)
Checks supported languages
- MineyMap - Installer.exe (PID: 3576)
- MineyMap - Installer.exe (PID: 4724)
- OWInstaller.exe (PID: 1100)
Checks proxy server information
- MineyMap - Installer.exe (PID: 4724)
- OWInstaller.exe (PID: 1100)
- dxdiag.exe (PID: 1976)
Creates files in the program directory
- MineyMap - Installer.exe (PID: 4724)
Creates files or folders in the user directory
- MineyMap - Installer.exe (PID: 4724)
- OWInstaller.exe (PID: 1100)
- dxdiag.exe (PID: 1976)
Reads the machine GUID from the registry
- OWInstaller.exe (PID: 1100)
Reads product name
- OWInstaller.exe (PID: 1100)
Reads Environment values
- OWInstaller.exe (PID: 1100)
Process checks computer location settings
- OWInstaller.exe (PID: 1100)
- MineyMap - Installer.exe (PID: 3576)
Disables trace logs
- OWInstaller.exe (PID: 1100)
Reads the software policy settings
- OWInstaller.exe (PID: 1100)
- dxdiag.exe (PID: 1976)
Reads security settings of Internet Explorer
- dxdiag.exe (PID: 1976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:09:25 21:57:46+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 27136 |
| InitializedDataSize: | 186880 |
| UninitializedDataSize: | 2048 |
| EntryPoint: | 0x352d |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.282.0.1 |
| ProductVersionNumber: | 2.282.0.1 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | Overwolf Ltd. |
| FileDescription: | Overwolf |
| FileVersion: | 2.282.0.1 |
| LegalCopyright: | Copyright (C) 2021 Overwolf Ltd. All Rights Reserved. |
| LegalTrademarks: | - |
| ProductName: | Overwolf |
| ProductVersion: | 2.282.0.1 |
Total processes
139
Monitored processes
5
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1100 | "C:\ProgramData\temp\nshCC25.tmp\OWinstaller.exe" Sel=1&Channel=web_dl_btn&Extension=blgibcgmfheopafbgiginhhjhkkiadancbliicha&Name=MineyMap&UtmContent=new-light&Referer=www.overwolf.com&Browser=firefox /UAC:A02EA /NCRC -partnerCustomizationLevel 0 -exepath C:\Users\admin\AppData\Local\Temp\MineyMap - Installer.exe | C:\ProgramData\temp\nshCC25.tmp\OWInstaller.exe | MineyMap - Installer.exe | ||||||||||||
User: admin Company: Overwolf Integrity Level: HIGH Description: Overwolf Installer Version: 2.282.0.1 Modules
| |||||||||||||||
| 1976 | "C:\WINDOWS\System32\DxDiag.exe" /xC:\Users\admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml | C:\Windows\System32\dxdiag.exe | OWInstaller.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft DirectX Diagnostic Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3576 | "C:\Users\admin\AppData\Local\Temp\MineyMap - Installer.exe" | C:\Users\admin\AppData\Local\Temp\MineyMap - Installer.exe | explorer.exe | ||||||||||||
User: admin Company: Overwolf Ltd. Integrity Level: MEDIUM Description: Overwolf Version: 2.282.0.1 Modules
| |||||||||||||||
| 4724 | "C:\Users\admin\AppData\Local\Temp\MineyMap - Installer.exe" /UAC:A02EA /NCRC | C:\Users\admin\AppData\Local\Temp\MineyMap - Installer.exe | MineyMap - Installer.exe | ||||||||||||
User: admin Company: Overwolf Ltd. Integrity Level: HIGH Description: Overwolf Version: 2.282.0.1 Modules
| |||||||||||||||
| 7124 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
9 173
Read events
9 012
Write events
140
Delete events
21
Modification events
| (PID) Process: | (4724) MineyMap - Installer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4724) MineyMap - Installer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4724) MineyMap - Installer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\OverwolfPersist |
| Operation: | write | Name: | MUIDV2 |
Value: 6e55ae6c-5b06-4847-bd46-199c7021496c | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\OverwolfPersist |
| Operation: | write | Name: | MUIDV2 |
Value: 6e55ae6c-5b06-4847-bd46-199c7021496c | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1100) OWInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\OWinstaller_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
20
Suspicious files
42
Text files
70
Unknown types
13
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3576 | MineyMap - Installer.exe | C:\Users\admin\AppData\Local\Temp\nstC966.tmp\System.dll | executable | |
MD5:51BD16A2EA23AE1E7A92CEDC6785C82E | SHA256:4DBC79D2B1C7987CC64BB5D014DB81BB5108BDD6D8BF3A5F820FAC1DED62BE33 | |||
| 3576 | MineyMap - Installer.exe | C:\Users\admin\AppData\Local\Temp\nstC966.tmp\uac.dll | executable | |
MD5:861F7E800BB28F68927E65719869409C | SHA256:10A0E8CF46038AB3B2C3CF5DCE407B9A043A631CBDE9A5C8BCF0A54B2566C010 | |||
| 3576 | MineyMap - Installer.exe | C:\Users\admin\AppData\Local\Temp\nstC966.tmp\nsProcess.dll | executable | |
MD5:10E47E822B85D2A12FA4727001612182 | SHA256:D530589A90918334B8E08D7355630892DD62F41333D948A860735D5BECFCB391 | |||
| 4724 | MineyMap - Installer.exe | C:\ProgramData\temp\nshCC25.tmp\Newtonsoft.Json.dll | executable | |
MD5:98CBB64F074DC600B23A2EE1A0F46448 | SHA256:7B44639CBFBC8DDAC8C7A3DE8FFA97A7460BEBB0D54E9FF2E1CCDC3A742C2B13 | |||
| 4724 | MineyMap - Installer.exe | C:\ProgramData\temp\nshCC25.tmp\OWInstaller.exe | executable | |
MD5:26B8E0369FBF44226FB3CE554A2C4BF5 | SHA256:4E5F39114CA3E099C2C55359FE151544DDD25501F6CCCC89665BE4FB33DB938A | |||
| 4724 | MineyMap - Installer.exe | C:\ProgramData\temp\nshCC25.tmp\CommandLine.dll | executable | |
MD5:210472E9E333D3329072C9EA3EF06326 | SHA256:569307401B949368527B128155B4E16B349803EC7D65C1052CC23C7B7A1336D8 | |||
| 4724 | MineyMap - Installer.exe | C:\ProgramData\temp\nshCC25.tmp\OverWolf.Client.CommonUtils.dll | executable | |
MD5:7B30A38CCC21B1B13207CCBFF8AF76AF | SHA256:DF06997247111BBB75E41A8291073845BAD54CBFCA49EA2E673F5152794814D7 | |||
| 4724 | MineyMap - Installer.exe | C:\ProgramData\temp\nshCC25.tmp\SharpRaven.dll | executable | |
MD5:271251960BF1D6A491803E15BD562E45 | SHA256:776C6B0642F7A3F3F3AD3CC6BB5F1D528E90C6029B671D8F82B0320B185B92A7 | |||
| 4724 | MineyMap - Installer.exe | C:\Users\admin\AppData\Local\Overwolf\OWInstall.log | text | |
MD5:07E605D2D7609CF336EA1708E86B5A0C | SHA256:C69AD6C6A1D6D89336E18DB86A6C852AB60C0CEB367C79922807E55DE7BE49DD | |||
| 4724 | MineyMap - Installer.exe | C:\Users\admin\AppData\Local\Temp\nskCB99.tmp\UserInfo.dll | executable | |
MD5:1DD4CA0F4A94155F8D46EC95A20ADA4A | SHA256:A27DC3069793535CB64123C27DCA8748983D133C8FA5AADDEE8CDBC83F16986D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
40
DNS requests
27
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1100 | OWInstaller.exe | GET | 200 | 18.66.145.213:80 | http://ocsp.rootca3.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRkNawYMzz%2BjKSfYbTyFR0AXuhs6QQUq7bb1waeN6wwhgeRcMecxBmxeMACEwdzEnA9eVH9TrLXPKuCavuqCA0%3D | unknown | — | — | whitelisted |
1100 | OWInstaller.exe | GET | 200 | 142.250.186.131:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
1100 | OWInstaller.exe | GET | 200 | 172.217.16.195:80 | http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEFU7gpI%2BIjtVECmkBcC3vbg%3D | unknown | — | — | whitelisted |
4724 | MineyMap - Installer.exe | GET | 200 | 18.244.18.51:80 | http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.282.0.1%22%7d%5d | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1976 | dxdiag.exe | GET | 200 | 23.55.110.193:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
1100 | OWInstaller.exe | GET | 200 | 18.66.145.213:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D | unknown | — | — | whitelisted |
3948 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5716 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1100 | OWInstaller.exe | GET | 200 | 142.250.186.131:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5968 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4724 | MineyMap - Installer.exe | 18.244.18.51:80 | analyticsnew.overwolf.com | — | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1100 | OWInstaller.exe | 142.250.185.174:80 | www.google-analytics.com | GOOGLE | US | whitelisted |
1100 | OWInstaller.exe | 18.244.18.51:443 | analyticsnew.overwolf.com | — | US | whitelisted |
1100 | OWInstaller.exe | 18.245.86.39:443 | content.overwolf.com | — | US | whitelisted |
1100 | OWInstaller.exe | 18.172.112.62:443 | storeapi.overwolf.com | — | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
analyticsnew.overwolf.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
content.overwolf.com |
| whitelisted |
storeapi.overwolf.com |
| shared |
ocsp.rootca3.amazontrust.com |
| whitelisted |
console-apps.overwolf.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| whitelisted |
www.overwolf.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4724 | MineyMap - Installer.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) |
— | — | Misc activity | ET INFO Observed UA-CPU Header |
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |