File name:

zipsoft-install__489__[866].exe

Full analysis: https://app.any.run/tasks/8f2e8380-e305-4ecf-ae9f-aedf2042adc2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 16, 2025, 06:55:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

1EBC42D2F7D9AE24093F5C058303E8B6

SHA1:

3BC4B02E67394A70DB44E43F832CADF9DDF44CA3

SHA256:

277C26F96F924F7875B78678D6F3A45C5AE2D0D4A7BC98B2789977DFC0A4843B

SSDEEP:

24576:UhFlBauLCPSBffyyyyyyyyyyyyK7VVzoTF3D9jV6XfE3Fzv6qlUqEX:UhFl7CEyyyyyyyyyyyyK7VF2F3D9jV6p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup.exe (PID: 4008)
      • setup.exe (PID: 664)
      • setup.exe (PID: 516)
      • setup.exe (PID: 6744)

    • Steals credentials from Web Browsers

      • setup.exe (PID: 4008)
      • setup.exe (PID: 664)
      • setup.exe (PID: 6744)
      • setup.exe (PID: 516)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • zipsoft-install__489__[866].exe (PID: 7408)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • setup.exe (PID: 664)

    • Executable content was dropped or overwritten

      • zipsoft-install__489__[866].exe (PID: 7408)
      • OperaSetup.exe (PID: 7296)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • CPU-Z.tmp (PID: 5408)
      • CPU-Z.exe (PID: 4428)
      • setup.exe (PID: 4008)
      • setup.exe (PID: 664)
      • setup.exe (PID: 6560)
      • setup.exe (PID: 516)
      • setup.exe (PID: 6744)

    • Application launched itself

      • setup.exe (PID: 664)
      • setup.exe (PID: 516)

    • Starts itself from another location

      • setup.exe (PID: 664)

    • Potential Corporate Privacy Violation

      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)

    • Process requests binary or script from the Internet

      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)

  • INFO

    • Checks proxy server information

      • zipsoft-install__489__[866].exe (PID: 7408)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • setup.exe (PID: 664)

    • Disables trace logs

      • zipsoft-install__489__[866].exe (PID: 7408)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)

    • Reads the computer name

      • zipsoft-install__489__[866].exe (PID: 7408)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • CPU-Z.exe (PID: 4428)
      • CPU-Z.tmp (PID: 5408)
      • setup.exe (PID: 664)
      • setup.exe (PID: 516)

    • Checks supported languages

      • zipsoft-install__489__[866].exe (PID: 7408)
      • OperaSetup.exe (PID: 7296)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • setup.exe (PID: 664)
      • CPU-Z.exe (PID: 4428)
      • setup.exe (PID: 4008)
      • CPU-Z.tmp (PID: 5408)
      • setup.exe (PID: 6560)
      • setup.exe (PID: 6744)
      • setup.exe (PID: 516)

    • Reads the machine GUID from the registry

      • zipsoft-install__489__[866].exe (PID: 7408)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • setup.exe (PID: 664)

    • Create files in a temporary directory

      • zipsoft-install__489__[866].exe (PID: 7408)
      • OperaSetup.exe (PID: 7296)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • setup.exe (PID: 664)
      • CPU-Z.tmp (PID: 5408)
      • CPU-Z.exe (PID: 4428)
      • setup.exe (PID: 4008)
      • setup.exe (PID: 6560)
      • setup.exe (PID: 6744)
      • setup.exe (PID: 516)

    • The sample compiled with english language support

      • zipsoft-install__489__[866].exe (PID: 7408)
      • OperaSetup.exe (PID: 7296)
      • 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe (PID: 1760)
      • setup.exe (PID: 664)
      • setup.exe (PID: 4008)
      • setup.exe (PID: 6560)
      • setup.exe (PID: 516)
      • setup.exe (PID: 6744)

    • Reads the software policy settings

      • zipsoft-install__489__[866].exe (PID: 7408)
      • setup.exe (PID: 664)

    • Process checks computer location settings

      • zipsoft-install__489__[866].exe (PID: 7408)

    • Creates files or folders in the user directory

      • setup.exe (PID: 4008)
      • setup.exe (PID: 664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2068:07:13 07:03:51+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 1038336
InitializedDataSize: 7680
UninitializedDataSize: -
EntryPoint: 0xff7a6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.7.0
ProductVersionNumber: 2.0.7.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Install any useful software with a single click
CompanyName: ROSTPAY LTD
FileDescription: ZipSoft
FileVersion: 2.0.7.0
InternalName: ZipSoft.exe
LegalCopyright: © ROSTPAY LTD. All rights reserved.
LegalTrademarks: -
OriginalFileName: ZipSoft.exe
ProductName: ZipSoft
ProductVersion: 2.0.7.0
AssemblyVersion: 2.0.7.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
14
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start zipsoft-install__489__[866].exe sppextcomobj.exe no specs slui.exe no specs 6a165cbe-fed1-49f5-b460-825b4cd5873e.exe operasetup.exe setup.exe cpu-z.exe setup.exe cpu-z.tmp setup.exe setup.exe setup.exe svchost.exe zipsoft-install__489__[866].exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=0 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=664 --package-dir-prefix="C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20250416065612" --session-guid=9c3c2497-61c0-47c9-ad9f-64c88dbe1c73 --server-tracking-blob=MDU0MDE5NmU0NWZmNTkzZjYyZjYzYzIzZjkyYjRiYjljMTM3YTgwZWQ1M2UzZDViYjM2MTM4YmFkYzRmNTk2MDp7ImNvdW50cnkiOiJERSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDE3NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc0NDc4NjU2OS45MzA2IiwidXNlcmFnZW50IjoiWmlwU29mdFdyYXBwZXIvMi4wLjcuMCAxMC4wL3g2NCIsInV0bSI6eyJjYW1wYWlnbiI6Im9wMTc3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiUlNUUCJ9LCJ1dWlkIjoiYzg5NzdkMGItMjNjNS00MjMxLTk2MzctOGUxMWE1YjQ2YWUzIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6405000000000000C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera Installer
Version:
118.0.5461.41
Modules
Images
c:\users\admin\appdata\local\temp\7zs08c20d31\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
664C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe --silent --allusers=0 --setdefaultbrowser=0 --pin-additional-shortcuts=0 --server-tracking-blob=Y2JmMTJjMTQyZTQ4MzZlODY3ZWVkMDVkMjcwYTFjZWVlM2E4OTkwN2YxYTc0NzVmMGQwZmNmMGIzZTFhZmI3Yjp7ImNvdW50cnkiOiJERSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDE3NyIsInRpbWVzdGFtcCI6IjE3NDQ3ODY1NjkuOTMwNiIsInVzZXJhZ2VudCI6IlppcFNvZnRXcmFwcGVyLzIuMC43LjAgMTAuMC94NjQiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvcDE3NyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6IlJTVFAifSwidXVpZCI6ImM4OTc3ZDBiLTIzYzUtNDIzMS05NjM3LThlMTFhNWI0NmFlMyJ9C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe
OperaSetup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera Installer
Version:
118.0.5461.41
Modules
Images
c:\users\admin\appdata\local\temp\7zs08c20d31\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1760"C:\Users\admin\AppData\Local\Temp\6a165cbe-fed1-49f5-b460-825b4cd5873e.exe" /sC:\Users\admin\AppData\Local\Temp\6a165cbe-fed1-49f5-b460-825b4cd5873e.exe
zipsoft-install__489__[866].exe
User:
admin
Company:
Qihoo 360 Technology Co. Ltd.
Integrity Level:
HIGH
Description:
360 Total Security Online Installer
Version:
6, 6, 0, 1054
Modules
Images
c:\users\admin\appdata\local\temp\6a165cbe-fed1-49f5-b460-825b4cd5873e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4008C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=118.0.5461.41 --initial-client-data=0x28c,0x290,0x294,0x250,0x298,0x7ffc89aed808,0x7ffc89aed814,0x7ffc89aed820C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera Installer
Version:
118.0.5461.41
Modules
Images
c:\users\admin\appdata\local\temp\7zs08c20d31\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4428"C:\Users\admin\AppData\Local\Temp\ZipSoft\CPU-Z.exe" C:\Users\admin\AppData\Local\Temp\ZipSoft\CPU-Z.exe
zipsoft-install__489__[866].exe
User:
admin
Company:
CPUID, Inc.
Integrity Level:
HIGH
Description:
CPUID CPU-Z Setup
Exit code:
2
Version:
Modules
Images
c:\users\admin\appdata\local\temp\zipsoft\cpu-z.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
5408"C:\Users\admin\AppData\Local\Temp\is-UL19R.tmp\CPU-Z.tmp" /SL5="$B02D4,2745933,776192,C:\Users\admin\AppData\Local\Temp\ZipSoft\CPU-Z.exe" C:\Users\admin\AppData\Local\Temp\is-UL19R.tmp\CPU-Z.tmp
CPU-Z.exe
User:
admin
Company:
CPUID, Inc.
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
2
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ul19r.tmp\cpu-z.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
6560"C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --versionC:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera Installer
Exit code:
0
Version:
118.0.5461.41
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera installer temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6744C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=118.0.5461.41 --initial-client-data=0x238,0x23c,0x240,0x264,0x29c,0x7ffc87c2d808,0x7ffc87c2d814,0x7ffc87c2d820C:\Users\admin\AppData\Local\Temp\7zS08C20D31\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera Installer
Version:
118.0.5461.41
Modules
Images
c:\users\admin\appdata\local\temp\7zs08c20d31\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7296"C:\Users\admin\AppData\Local\Temp\OperaSetup.exe" --silent --allusers=0 --setdefaultbrowser=0 --pin-additional-shortcuts=0C:\Users\admin\AppData\Local\Temp\OperaSetup.exe
zipsoft-install__489__[866].exe
User:
admin
Integrity Level:
HIGH
Description:
Opera installer SFX
Version:
118.0.5461.41
Modules
Images
c:\users\admin\appdata\local\temp\operasetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
4 985
Read events
4 938
Write events
42
Delete events
5

Modification events

(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_CURRENT_USER\SOFTWARE\ZipSoft
Operation:writeName:appId
Value:
{ae158605-6209-49b3-9c48-ec3ade29e3b9}
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_CURRENT_USER\SOFTWARE\ZipSoft
Operation:writeName:arch
Value:
10.0/x64
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7408) zipsoft-install__489__[866].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zipsoft-install__489__[866]_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
15
Suspicious files
16
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7408zipsoft-install__489__[866].exeC:\Users\admin\AppData\Local\Temp\OperaSetup.exeexecutable
MD5:C9FC5D11D908661ADA332FE80BB75CEF
SHA256:BA786CB6E20D3899D4FF1A39B7EC7BD0F7F77CA4AA818FD06B96382899C8D55B
7408zipsoft-install__489__[866].exeC:\Users\admin\AppData\Local\Temp\6a165cbe-fed1-49f5-b460-825b4cd5873e.exeexecutable
MD5:2B2ACF2A1498A1F7785A5CF8CCDA7AC0
SHA256:0F9D4CAFF5B78548200212F121845231E355B88BC0EE3CEA50B863E9132EEA79
664setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_250416065611574664.dllexecutable
MD5:83EB2F48045104FE716F0308EB7AEC4C
SHA256:0CABD4D09D54B363C97B27D4DEF1DB5CB184F9B3AC129856DD4B71C17F986F21
664setup.exeC:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datbinary
MD5:03DF589F2D15324F2D86DADD06752D9F
SHA256:21CC36D9CA0620E452289AD0E98D013C0EE064EC09919B7AE988EA619B6FC6C5
17606a165cbe-fed1-49f5-b460-825b4cd5873e.exeC:\Users\admin\AppData\Local\Temp\!@t5234.tmp.dir\setup.initext
MD5:5B5683450856466E0588DB6EBB6F8CEE
SHA256:984702CFB4EF051B10DF64ACFAF1F9102DD75A96E916B3F062775A55D08DA9D3
664setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:04B761F341AF9C3C7684F3700236A55E
SHA256:1B12AC540FF922B07E88D58E9F43E1533C0AC5B9547207D117226ABD601BC7A6
6560setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2504160656121906560.dllexecutable
MD5:83EB2F48045104FE716F0308EB7AEC4C
SHA256:0CABD4D09D54B363C97B27D4DEF1DB5CB184F9B3AC129856DD4B71C17F986F21
17606a165cbe-fed1-49f5-b460-825b4cd5873e.exeC:\Users\admin\AppData\Local\Temp\{44E4B53D-A21E-4f23-9C2B-C2753EEE1386}.tmp\360P2SP.dllexecutable
MD5:FC1796ADD9491EE757E74E65CEDD6AE7
SHA256:BF1B96F5B56BE51E24D6314BC7EC25F1BDBA2435F4DFC5BE87DE164FE5DE9E60
7408zipsoft-install__489__[866].exeC:\Users\admin\AppData\Local\Temp\tmp4D9A.tmpexecutable
MD5:CA5302C498DBA1DCC8D5C815059BF61D
SHA256:E981F2E81DA7893240D4D0904E09ED5DD045C27EF415BBA9AE7C9D70BC8E8906
17606a165cbe-fed1-49f5-b460-825b4cd5873e.exeC:\Users\admin\AppData\Local\Temp\{CC859B6D-52C3-4101-95F7-EDCC21DC97FD}.tmpcompressed
MD5:7D883E7A121DD2A690E3A04BB196DA6F
SHA256:9A54E77EDD072495D1A9C0BBA781F14C63F344EAAFA4F466D3DE770979691410
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
61
DNS requests
34
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1760
6a165cbe-fed1-49f5-b460-825b4cd5873e.exe
GET
200
151.236.118.173:80
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab
unknown
—
—
whitelisted
664
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
664
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
—
—
whitelisted
664
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEA17ZgsSl63KHstWnAbUez0%3D
unknown
—
—
whitelisted
664
setup.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
664
setup.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7408
zipsoft-install__489__[866].exe
188.130.153.33:443
api.zip-soft.net
Rostpay Ltd
RU
suspicious
7408
zipsoft-install__489__[866].exe
188.130.153.32:443
api.zip-soft.net
Rostpay Ltd
RU
suspicious
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.142
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
api.zip-soft.net
  • 188.130.153.33
  • 188.130.153.32
unknown
api.az-partners.net
  • 188.130.153.32
  • 188.130.153.33
unknown
login.live.com
  • 40.126.31.131
  • 20.190.159.131
  • 20.190.159.71
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.2
  • 20.190.159.4
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.zip-soft.net
  • 188.130.153.32
  • 188.130.153.33
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
1760
6a165cbe-fed1-49f5-b460-825b4cd5873e.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1760
6a165cbe-fed1-49f5-b460-825b4cd5873e.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zipsoft-install__489__[866].exe