File name:

7l_ready-or-not_setup.exe

Full analysis: https://app.any.run/tasks/7de97802-49cd-45f0-adbe-2190454c51a9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 13, 2025, 21:49:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
bittorrent
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

C00F8E5CD405148EF8ABCD5282E69E2D

SHA1:

D860BFDA0516D859B049304AE98C6BDF1576F362

SHA256:

2C79D9DD8D59FFA28C916461B91CF378F05F63C544E45C02E842F255C657CE60

SSDEEP:

98304:vrq3BdwNyAIZ9Pu1fhmS9I2yHtvyJFG5pzmoKEqOi7OPO8duYqzxwbEzgCYaTbJK:kWXZa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BITTORRENT has been detected (SURICATA)

      • aria2c.exe (PID: 536)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7l_ready-or-not_setup.exe (PID: 5064)
      • 7l_ready-or-not_setup.exe (PID: 7148)
      • 7l_ready-or-not_setup.tmp (PID: 976)
      • Run_ReadyOrNot.exe (PID: 6132)

    • Reads security settings of Internet Explorer

      • 7l_ready-or-not_setup.tmp (PID: 1628)
      • 7l_ready-or-not_setup.tmp (PID: 976)
      • Run_ReadyOrNot.exe (PID: 6132)

    • Reads the Windows owner or organization settings

      • 7l_ready-or-not_setup.tmp (PID: 976)

    • Uses TASKKILL.EXE to kill process

      • 7l_ready-or-not_setup.tmp (PID: 976)

    • Starts CMD.EXE for commands execution

      • 7l_ready-or-not_setup.tmp (PID: 976)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 2096)

    • Reads Microsoft Outlook installation path

      • Run_ReadyOrNot.exe (PID: 6132)

    • Reads Internet Explorer settings

      • Run_ReadyOrNot.exe (PID: 6132)

    • Process requests binary or script from the Internet

      • Run_ReadyOrNot.exe (PID: 6132)

    • Connects to unusual port

      • aria2c.exe (PID: 536)

    • There is functionality for taking screenshot (YARA)

      • Run_ReadyOrNot.exe (PID: 6132)

    • Potential Corporate Privacy Violation

      • aria2c.exe (PID: 536)

  • INFO

    • Create files in a temporary directory

      • 7l_ready-or-not_setup.exe (PID: 5064)
      • 7l_ready-or-not_setup.exe (PID: 7148)
      • 7l_ready-or-not_setup.tmp (PID: 976)

    • Checks supported languages

      • 7l_ready-or-not_setup.exe (PID: 5064)
      • 7l_ready-or-not_setup.tmp (PID: 1628)
      • 7l_ready-or-not_setup.tmp (PID: 976)
      • 7l_ready-or-not_setup.exe (PID: 7148)
      • Run_ReadyOrNot.exe (PID: 6132)
      • aria2c.exe (PID: 536)

    • Reads the computer name

      • 7l_ready-or-not_setup.tmp (PID: 1628)
      • 7l_ready-or-not_setup.exe (PID: 7148)
      • 7l_ready-or-not_setup.tmp (PID: 976)
      • Run_ReadyOrNot.exe (PID: 6132)
      • aria2c.exe (PID: 536)

    • Process checks computer location settings

      • 7l_ready-or-not_setup.tmp (PID: 1628)
      • 7l_ready-or-not_setup.tmp (PID: 976)

    • Creates files in the program directory

      • 7l_ready-or-not_setup.tmp (PID: 976)
      • Run_ReadyOrNot.exe (PID: 6132)
      • aria2c.exe (PID: 536)

    • The sample compiled with english language support

      • 7l_ready-or-not_setup.tmp (PID: 976)
      • Run_ReadyOrNot.exe (PID: 6132)

    • Creates a software uninstall entry

      • 7l_ready-or-not_setup.tmp (PID: 976)

    • Detects InnoSetup installer (YARA)

      • 7l_ready-or-not_setup.exe (PID: 5064)
      • 7l_ready-or-not_setup.tmp (PID: 1628)

    • Compiled with Borland Delphi (YARA)

      • 7l_ready-or-not_setup.exe (PID: 5064)
      • 7l_ready-or-not_setup.tmp (PID: 1628)
      • Run_ReadyOrNot.exe (PID: 6132)

    • Process checks whether UAC notifications are on

      • Run_ReadyOrNot.exe (PID: 6132)

    • Reads the machine GUID from the registry

      • Run_ReadyOrNot.exe (PID: 6132)
      • aria2c.exe (PID: 536)

    • Checks proxy server information

      • Run_ReadyOrNot.exe (PID: 6132)
      • slui.exe (PID: 780)

    • Creates files or folders in the user directory

      • Run_ReadyOrNot.exe (PID: 6132)

    • Reads the software policy settings

      • Run_ReadyOrNot.exe (PID: 6132)
      • slui.exe (PID: 780)
      • slui.exe (PID: 6268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 186880
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.5.6.0
ProductVersionNumber: 1.5.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: SE7EN Solutions
FileDescription: 7Launcher - Ready or Not Setup
FileVersion: 1.5.6
LegalCopyright: SE7EN Solutions
OriginalFileName:
ProductName: 7Launcher - Ready or Not 1.5.6
ProductVersion: 1.5.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
19
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 7l_ready-or-not_setup.exe 7l_ready-or-not_setup.tmp no specs 7l_ready-or-not_setup.exe 7l_ready-or-not_setup.tmp sppextcomobj.exe no specs slui.exe taskkill.exe no specs conhost.exe no specs run_readyornot.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs #BITTORRENT aria2c.exe conhost.exe no specs slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\Ready or Not\7launcher\tools\aria2\aria2c.exe" "http://updater.se7enkills.net/torrents/ready-or-not_latest.torrent" --follow-torrent=mem --human-readable=false --conf-path="C:\Program Files\Ready or Not\7launcher\tools\aria2\aria2.conf" --listen-port=10778 --dht-listen-port=10778 --dir="C:\Program Files\Ready or Not\!Setup"C:\Program Files\Ready or Not\7launcher\tools\aria2\aria2c.exe
Run_ReadyOrNot.exe
User:
admin
Company:
SE7EN Solutions Ltd.
Integrity Level:
HIGH
Description:
aria2
Version:
1.36.0.0
Modules
Images
c:\program files\ready or not\7launcher\tools\aria2\aria2c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
780C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
976"C:\Users\admin\AppData\Local\Temp\is-9JBD4.tmp\7l_ready-or-not_setup.tmp" /SL5="$402A2,2104405,872960,C:\Users\admin\AppData\Local\Temp\7l_ready-or-not_setup.exe" /SPAWNWND=$402D2 /NOTIFYWND=$50312 C:\Users\admin\AppData\Local\Temp\is-9JBD4.tmp\7l_ready-or-not_setup.tmp
7l_ready-or-not_setup.exe
User:
admin
Company:
SE7EN Solutions
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-9jbd4.tmp\7l_ready-or-not_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1628"C:\Users\admin\AppData\Local\Temp\is-RBEH7.tmp\7l_ready-or-not_setup.tmp" /SL5="$50312,2104405,872960,C:\Users\admin\AppData\Local\Temp\7l_ready-or-not_setup.exe" C:\Users\admin\AppData\Local\Temp\is-RBEH7.tmp\7l_ready-or-not_setup.tmp—7l_ready-or-not_setup.exe
User:
admin
Company:
SE7EN Solutions
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-rbeh7.tmp\7l_ready-or-not_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2096"cmd.exe" /c netsh advfirewall firewall add rule name="7Launcher P2P In" dir=in action=allow program="C:\Program Files\Ready or Not\7launcher\tools\aria2\aria2c.exe" description="7Launcher P2P In" enable=yes profile=any edge=yes interfacetype=any & netsh advfirewall firewall add rule name="7Launcher P2P Out" dir=out action=allow program="C:\Program Files\Ready or Not\7launcher\tools\aria2\aria2c.exe" description="7Launcher P2P Out" enable=yes profile=any interfacetype=any & netsh advfirewall firewall add rule name="7Launcher - Ready or Not In" dir=in action=allow program="C:\Program Files\Ready or Not\Run_ReadyorNot.exe" description="7Launcher - Ready or Not In" enable=yes profile=any edge=yes interfacetype=any & netsh advfirewall firewall add rule name="7Launcher - Ready or Not Out" dir=out action=allow program="C:\Program Files\Ready or Not\Run_ReadyorNot.exe" description="7Launcher - Ready or Not Out" enable=yes profile=any interfacetype=anyC:\Windows\System32\cmd.exe—7l_ready-or-not_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2108C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268netsh advfirewall firewall add rule name="7Launcher - Ready or Not Out" dir=out action=allow program="C:\Program Files\Ready or Not\Run_ReadyorNot.exe" description="7Launcher - Ready or Not Out" enable=yes profile=any interfacetype=anyC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884"taskkill.exe" /f /im "Run_ReadyorNot.exe"C:\Windows\System32\taskkill.exe—7l_ready-or-not_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
5 471
Read events
5 438
Write events
33
Delete events
0

Modification events

(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\SE7EN\7Launcher - Ready or Not
Operation:writeName:InstallDir
Value:
C:\Program Files\Ready or Not
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\SE7EN\7Launcher - Ready or Not
Operation:writeName:GameEXE
Value:
C:\Program Files\Ready or Not\bin\readyornot.exe
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\SE7EN\7Launcher - Ready or Not
Operation:writeName:LauncherEXE
Value:
C:\Program Files\Ready or Not\Run_ReadyorNot.exe
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.3
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Ready or Not
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Ready or Not\
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:Inno Setup: Icon Group
Value:
7Launcher
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(976) 7l_ready-or-not_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7Launcher - Ready or Not_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
Executable files
10
Suspicious files
21
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
9767l_ready-or-not_setup.tmpC:\Users\admin\AppData\Local\Temp\is-J32HA.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
9767l_ready-or-not_setup.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\7Launcher\Ready or Not [7L].lnkbinary
MD5:218C3D6BCE10C88123E10267A386E42E
SHA256:0DAF23959B8F8E88F078E9DE2DAAABD7475E50220F7B2233F796EADA4021C865
9767l_ready-or-not_setup.tmpC:\Users\admin\AppData\Local\Temp\is-J32HA.tmp\_isetup\_iscrypt.dllexecutable
MD5:F036861817595C58AE92A6A00FC1CFA8
SHA256:8623787D415532B869ED0E37B33E2063F974F33A0E366431A59E7DB8B7587F58
50647l_ready-or-not_setup.exeC:\Users\admin\AppData\Local\Temp\is-RBEH7.tmp\7l_ready-or-not_setup.tmpexecutable
MD5:F4283AF220663A9FA7CB383F20C9C469
SHA256:5FC9D60E38898D55E7C29F54DAED92C8A8F39B496A54FABC6D4D3C54DFB9B5E1
9767l_ready-or-not_setup.tmpC:\Program Files\Ready or Not\7launcher\is-VBQKR.tmpbinary
MD5:1D82371CDEDBE7D7684365105E750900
SHA256:3C6E5D1128015943888FF56C5691292592EAA1E96DA9EA244E56AAFBF3695E6D
9767l_ready-or-not_setup.tmpC:\Program Files\Ready or Not\7launcher\ReadyorNot_icon.icobinary
MD5:1D82371CDEDBE7D7684365105E750900
SHA256:3C6E5D1128015943888FF56C5691292592EAA1E96DA9EA244E56AAFBF3695E6D
71487l_ready-or-not_setup.exeC:\Users\admin\AppData\Local\Temp\is-9JBD4.tmp\7l_ready-or-not_setup.tmpexecutable
MD5:F4283AF220663A9FA7CB383F20C9C469
SHA256:5FC9D60E38898D55E7C29F54DAED92C8A8F39B496A54FABC6D4D3C54DFB9B5E1
9767l_ready-or-not_setup.tmpC:\Program Files\Ready or Not\uninstall7l\is-CQAVM.tmpexecutable
MD5:F4283AF220663A9FA7CB383F20C9C469
SHA256:5FC9D60E38898D55E7C29F54DAED92C8A8F39B496A54FABC6D4D3C54DFB9B5E1
9767l_ready-or-not_setup.tmpC:\Program Files\Ready or Not\is-SAC0R.tmpexecutable
MD5:D2D21FEEEB8EEE20FA28CD203D4013F7
SHA256:C97DF7E491CA6FD1A46D9BE360F7CAF9C57DDFD03DFF508C272640928E8B7E73
9767l_ready-or-not_setup.tmpC:\Program Files\Ready or Not\Run_ReadyOrNot.exeexecutable
MD5:D2D21FEEEB8EEE20FA28CD203D4013F7
SHA256:C97DF7E491CA6FD1A46D9BE360F7CAF9C57DDFD03DFF508C272640928E8B7E73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
294
DNS requests
28
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6132
Run_ReadyOrNot.exe
GET
200
188.114.97.3:80
http://updater.se7enkills.net/readyornot/inf.ini
unknown
—
—
whitelisted
6132
Run_ReadyOrNot.exe
GET
200
188.114.97.3:80
http://updater.se7enkills.net/readyornot/en/
unknown
—
—
whitelisted
756
lsass.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6132
Run_ReadyOrNot.exe
GET
200
188.114.97.3:80
http://updater.se7enkills.net/tools/aria2/aria2c.exe.lzma
unknown
—
—
whitelisted
536
aria2c.exe
GET
206
104.21.37.86:80
http://vasyan.space/c/Ready%20or%20Not%20Repack%20by%20SE7EN/Data/data-26.bin
unknown
—
—
malicious
536
aria2c.exe
GET
200
188.114.97.3:80
http://updater.se7enkills.net/torrents/ready-or-not_latest.torrent
unknown
—
—
whitelisted
536
aria2c.exe
GET
—
104.21.37.86:80
http://vasyan.space/c/Ready%20or%20Not%20Repack%20by%20SE7EN/Data/data-76.bin
unknown
—
—
malicious
536
aria2c.exe
GET
200
104.21.19.213:80
http://tracker.7n.re/announce?info_hash=L%93%CE%E7%FC%F8%9Dg%98%D7%B6%5Dm%ED%A2%09%87%15s%5C&peer_id=A2-1-36-0-%FE%EC%8C%D5%97%27%04%08pT&uploaded=0&downloaded=0&left=50136209702&compact=1&key=%8C%D5%97%27%04%08pT&numwant=50&no_peer_id=1&port=10778&event=started&supportcrypto=1
unknown
—
—
malicious
536
aria2c.exe
GET
206
104.21.37.86:80
http://vasyan.space/c/Ready%20or%20Not%20Repack%20by%20SE7EN/Data/data-51.bin
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.173:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.173
  • 23.48.23.166
  • 23.48.23.156
  • 23.48.23.164
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.4
  • 40.126.32.140
  • 20.190.160.132
  • 20.190.160.17
  • 20.190.160.130
  • 40.126.32.74
  • 20.190.160.5
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
updater.se7enkills.net
  • 188.114.97.3
  • 188.114.96.3
whitelisted
www.googletagmanager.com
  • 142.250.184.200
whitelisted
c.pki.goog
  • 142.250.185.195
whitelisted
o.pki.goog
  • 142.250.185.195
whitelisted

Threats

PID
Process
Class
Message
536
aria2c.exe
Potential Corporate Privacy Violation
ET P2P Possible Torrent Download via HTTP Request
536
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
536
aria2c.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent - Torrent File Downloaded
536
aria2c.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
536
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
536
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
536
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
536
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
536
aria2c.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
536
aria2c.exe
Potential Corporate Privacy Violation
GPL P2P BitTorrent announce request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7l_ready-or-not_setup.exe