File name:

CodeMeterRuntimeReduced.exe

Full analysis: https://app.any.run/tasks/cdd824b3-97d1-4a43-8736-940ff735ffa9
Verdict: Malicious activity
Analysis date: December 01, 2023, 03:34:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F0C9D4DB2514D6DC655AC1F6776A6A45

SHA1:

AF2C1794AA45150A53A66451F3285DC782E031C9

SHA256:

2FB295B1DAA9E7B961028E24393920ED52F9DC8A055E00D04757DBCDBAA452A7

SSDEEP:

98304:X0fQngk7A+RKUdWANUvHPBsVDE8xZDjFcK0zfOxSBbRU8SSHeqS+S+w3qVhRm7i8:lS+LucPMO1zxdj5AhO9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CodeMeterRuntimeReduced.exe (PID: 3008)
      • msiexec.exe (PID: 3100)

    • Starts NET.EXE for service management

      • net.exe (PID: 3496)
      • net.exe (PID: 3116)
      • msiexec.exe (PID: 3852)

    • Creates a writable file in the system directory

      • msiexec.exe (PID: 3100)

  • SUSPICIOUS

    • Adds/modifies Windows certificates

      • msiexec.exe (PID: 2308)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3868)
      • CodeMeter.exe (PID: 3688)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3100)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • msiexec.exe (PID: 3852)

  • INFO

    • Create files in a temporary directory

      • CodeMeterRuntimeReduced.exe (PID: 3008)
      • msiexec.exe (PID: 2308)
      • msiexec.exe (PID: 3100)

    • Checks supported languages

      • CodeMeterRuntimeReduced.exe (PID: 3008)
      • msiexec.exe (PID: 3100)
      • MSI7CC9.tmp (PID: 3296)
      • msiexec.exe (PID: 3436)
      • msiexec.exe (PID: 3852)
      • CodeMeter.exe (PID: 3688)
      • msiexec.exe (PID: 4052)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2308)

    • Reads the computer name

      • msiexec.exe (PID: 3100)
      • msiexec.exe (PID: 3436)
      • msiexec.exe (PID: 3852)
      • CodeMeter.exe (PID: 3688)
      • msiexec.exe (PID: 4052)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3100)
      • msiexec.exe (PID: 3436)
      • msiexec.exe (PID: 3852)
      • CodeMeter.exe (PID: 3688)
      • msiexec.exe (PID: 4052)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3100)

    • Application launched itself

      • msiexec.exe (PID: 3100)

    • Creates files in the program directory

      • CodeMeter.exe (PID: 3688)

    • Reads Environment values

      • CodeMeter.exe (PID: 3688)

    • Reads product name

      • CodeMeter.exe (PID: 3688)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (34.8)
.exe | Win32 Executable MS Visual C++ (generic) (25.2)
.exe | Win64 Executable (generic) (22.3)
.scr | Windows screen saver (10.6)
.exe | Win32 Executable (generic) (3.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:01:06 20:42:36+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 860160
InitializedDataSize: 13266944
UninitializedDataSize: -
EntryPoint: 0x8ee33
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.21.4624.507
ProductVersionNumber: 7.21.4624.507
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: CodeMeter Installer bootstrapper
CompanyName: WIBU SYSTEMS AG
FileDescription: CodeMeter
FileVersion: 7.21.4624.507
InternalName: -
LegalCopyright: (c) 2023 WIBU SYSTEMS AG
LegalTrademarks: All Rights Reserved
OLESelfRegister: -
OriginalFileName: -
PrivateBuild: -
ProductName: CodeMeter Installer
ProductVersion: 7.21.4624.507
SpecialBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
19
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start codemeterruntimereduced.exe msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs msi7cc9.tmp no specs msiexec.exe no specs msiexec.exe no specs net.exe no specs net1.exe no specs msiexec.exe no specs msiexec.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs net.exe no specs net1.exe no specs codemeter.exe no specs msiexec.exe no specs codemeterruntimereduced.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
844"C:\Users\admin\AppData\Local\Temp\CodeMeterRuntimeReduced.exe" C:\Users\admin\AppData\Local\Temp\CodeMeterRuntimeReduced.exe—explorer.exe
User:
admin
Company:
WIBU SYSTEMS AG
Integrity Level:
MEDIUM
Description:
CodeMeter
Exit code:
3221226540
Version:
7.21.4624.507
Modules
Images
c:\users\admin\appdata\local\temp\codemeterruntimereduced.exe
c:\windows\system32\ntdll.dll
2100"netsh" advfirewall firewall delete rule name="CodeMeter Runtime Server"C:\Windows\System32\netsh.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2308msiexec /i "C:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\CodeMeterRuntime32Reduced.msi" /l*v "C:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507_{6D132BDD-D54C-4483-98E9-00D391C0B862}_CodeMeterRuntime32Reduced.msi.log" ProductLanguage=1033C:\Windows\System32\msiexec.exe—CodeMeterRuntimeReduced.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3008"C:\Users\admin\AppData\Local\Temp\CodeMeterRuntimeReduced.exe" C:\Users\admin\AppData\Local\Temp\CodeMeterRuntimeReduced.exe
explorer.exe
User:
admin
Company:
WIBU SYSTEMS AG
Integrity Level:
HIGH
Description:
CodeMeter
Exit code:
0
Version:
7.21.4624.507
Modules
Images
c:\users\admin\appdata\local\temp\codemeterruntimereduced.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3100C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3116"C:\Windows\system32\net.exe" stop CodeMeter.exe /YC:\Windows\System32\net.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
3296"C:\Windows\Installer\MSI7CC9.tmp" /tC:\Windows\Installer\MSI7CC9.tmp—msiexec.exe
User:
admin
Company:
WIBU-SYSTEMS AG
Integrity Level:
HIGH
Description:
CleanUp
Exit code:
0
Version:
Version 7.21g of 2023-Aug-28(Build 4624)
Modules
Images
c:\windows\installer\msi7cc9.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3340"netsh" advfirewall firewall delete rule name="CodeMeterFWEx1"C:\Windows\System32\netsh.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3424C:\Windows\system32\net1 start CodeMeter.exe /YC:\Windows\System32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
3436C:\Windows\system32\MsiExec.exe -Embedding 49AD99205CAAC78E38D0178986FCC42FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
36 394
Read events
35 780
Write events
547
Delete events
67

Modification events

(PID) Process:(2308) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54
Operation:writeName:Blob
Value:
090000000100000034000000303206082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030106082B06010505070308190000000100000010000000AD6D6FF31B24013151F279E26A8C33240B000000010000006000000056006500720069005300690067006E00200055006E006900760065007200730061006C00200052006F006F0074002000430065007200740069006600690063006100740069006F006E00200041007500740068006F00720069007400790000006200000001000000200000002399561127A57125DE8CEFEA610DDF2FA078B5C8067F4E828290BFB860E84B3C140000000100000014000000B677FA6948479F5312D5C2EA07327607D19707191D0000000100000010000000439B4D52906DF7A01771D729528723B37F000000010000000C000000300A06082B060105050703017E00000001000000080000000040D0D1B0FFD4010300000001000000140000003679CA35668772304D30A5FB873B0FA77BB70D540F000000010000002000000017FE16F394EC70A5BB0C6784CAB40B1E61025AE9D50ECAA0531D6B4D997BBC5953000000010000004200000030403021060B6086480186F8450107170630123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C02000000001000000BD040000308204B9308203A1A0030201020210401AC46421B31321030EBBE4121AC51D300D06092A864886F70D01010B05003081BD310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E311F301D060355040B1316566572695369676E205472757374204E6574776F726B313A3038060355040B1331286329203230303820566572695369676E2C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79313830360603550403132F566572695369676E20556E6976657273616C20526F6F742043657274696669636174696F6E20417574686F72697479301E170D3038303430323030303030305A170D3337313230313233353935395A3081BD310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E311F301D060355040B1316566572695369676E205472757374204E6574776F726B313A3038060355040B1331286329203230303820566572695369676E2C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79313830360603550403132F566572695369676E20556E6976657273616C20526F6F742043657274696669636174696F6E20417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100C761375EB10134DB62D7159BFF585A8C2323D6608E91D79098837AE65819388CC5F6E56485B4A271FBEDBDB9DACD4D00B4C82D73A5C76971951F393CB244079CE80EFA4D4AC421DF29618F32226182C5871F6E8C7C5F16205144D1704F57EAE31CE3CC79EE58D80EC2B34593C02CE79A172B7B00377A413378E133E2F3101A7F872CBEF6F5F742E2E5BF8762895F004BDFC5DDE4754432413A1E716E69CB0B754608D1CAD22B95D0CFFBB9406B648C574DFC13117984ED5E54F6349F0801F3102506174ADAF11D7A666B986066A4D9EFD22E82F1F0EF09EA44C9156AE2036E33D3AC9F5500C7F6086A94B95FDCE033F18460F95B2711B4FC16F2BB566A80258D0203010001A381B23081AF300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106306D06082B0601050507010C0461305FA15DA05B3059305730551609696D6167652F6769663021301F300706052B0E03021A04148FE5D31A86AC8D8E6BC3CF806AD448182C7B192E30251623687474703A2F2F6C6F676F2E766572697369676E2E636F6D2F76736C6F676F2E676966301D0603551D0E04160414B677FA6948479F5312D5C2EA07327607D1970719300D06092A864886F70D01010B050003820101004AF8F8B003E62C677BE4947763CC6E4CF97D0E0DDCC8B935B9704F63FA24FA6C838C479D3B63F39AF976329591B177BCAC9ABEB1E43121C68195565A0EB1C2D4B1A659ACF163CBB84C1D59904AEF9016281F5AAE10FB8150380C6CCCF13DC3F563E3B3E321C92439E9FD156646F41B11D04D73A37D46F93DEDA85F62D4F13FF8E074572B189D81B4C428DA9497A570EBAC1DBE0711F0D5DBDDE58CF0D532B083E657E28FBFBEA1AABF3D1DB5D438EAD7B05C3A4F6A3F8FC0666C63AAE9D9A416F481D195140E7DCD9534D9D28F7073817B9C7EBD9861D845879890C5EB8630C635BFF0FFC35588834BEF05920671F2B89893B7ECCD8261F138E64F97982A5A8D
(PID) Process:(2308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54
Operation:writeName:Blob
Value:
0400000001000000100000008EADB501AA4D81E48C1DD1E11400951953000000010000004200000030403021060B6086480186F8450107170630123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C00F000000010000002000000017FE16F394EC70A5BB0C6784CAB40B1E61025AE9D50ECAA0531D6B4D997BBC590300000001000000140000003679CA35668772304D30A5FB873B0FA77BB70D547E00000001000000080000000040D0D1B0FFD4017F000000010000000C000000300A06082B060105050703011D0000000100000010000000439B4D52906DF7A01771D729528723B3140000000100000014000000B677FA6948479F5312D5C2EA07327607D19707196200000001000000200000002399561127A57125DE8CEFEA610DDF2FA078B5C8067F4E828290BFB860E84B3C0B000000010000006000000056006500720069005300690067006E00200055006E006900760065007200730061006C00200052006F006F0074002000430065007200740069006600690063006100740069006F006E00200041007500740068006F0072006900740079000000190000000100000010000000AD6D6FF31B24013151F279E26A8C3324090000000100000034000000303206082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030106082B060105050703082000000001000000BD040000308204B9308203A1A0030201020210401AC46421B31321030EBBE4121AC51D300D06092A864886F70D01010B05003081BD310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E311F301D060355040B1316566572695369676E205472757374204E6574776F726B313A3038060355040B1331286329203230303820566572695369676E2C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79313830360603550403132F566572695369676E20556E6976657273616C20526F6F742043657274696669636174696F6E20417574686F72697479301E170D3038303430323030303030305A170D3337313230313233353935395A3081BD310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E311F301D060355040B1316566572695369676E205472757374204E6574776F726B313A3038060355040B1331286329203230303820566572695369676E2C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79313830360603550403132F566572695369676E20556E6976657273616C20526F6F742043657274696669636174696F6E20417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100C761375EB10134DB62D7159BFF585A8C2323D6608E91D79098837AE65819388CC5F6E56485B4A271FBEDBDB9DACD4D00B4C82D73A5C76971951F393CB244079CE80EFA4D4AC421DF29618F32226182C5871F6E8C7C5F16205144D1704F57EAE31CE3CC79EE58D80EC2B34593C02CE79A172B7B00377A413378E133E2F3101A7F872CBEF6F5F742E2E5BF8762895F004BDFC5DDE4754432413A1E716E69CB0B754608D1CAD22B95D0CFFBB9406B648C574DFC13117984ED5E54F6349F0801F3102506174ADAF11D7A666B986066A4D9EFD22E82F1F0EF09EA44C9156AE2036E33D3AC9F5500C7F6086A94B95FDCE033F18460F95B2711B4FC16F2BB566A80258D0203010001A381B23081AF300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106306D06082B0601050507010C0461305FA15DA05B3059305730551609696D6167652F6769663021301F300706052B0E03021A04148FE5D31A86AC8D8E6BC3CF806AD448182C7B192E30251623687474703A2F2F6C6F676F2E766572697369676E2E636F6D2F76736C6F676F2E676966301D0603551D0E04160414B677FA6948479F5312D5C2EA07327607D1970719300D06092A864886F70D01010B050003820101004AF8F8B003E62C677BE4947763CC6E4CF97D0E0DDCC8B935B9704F63FA24FA6C838C479D3B63F39AF976329591B177BCAC9ABEB1E43121C68195565A0EB1C2D4B1A659ACF163CBB84C1D59904AEF9016281F5AAE10FB8150380C6CCCF13DC3F563E3B3E321C92439E9FD156646F41B11D04D73A37D46F93DEDA85F62D4F13FF8E074572B189D81B4C428DA9497A570EBAC1DBE0711F0D5DBDDE58CF0D532B083E657E28FBFBEA1AABF3D1DB5D438EAD7B05C3A4F6A3F8FC0666C63AAE9D9A416F481D195140E7DCD9534D9D28F7073817B9C7EBD9861D845879890C5EB8630C635BFF0FFC35588834BEF05920671F2B89893B7ECCD8261F138E64F97982A5A8D
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008C62D6BA16B0D901C80700002C0A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3100) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
400000000000000034645DBC16B0D901C80700002C0A0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
276
Suspicious files
11
Text files
212
Unknown types
0

Dropped files

PID
Process
Filename
Type
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\CodeMeterRuntime32Reduced.msiexecutable
MD5:46B6810ADE2AF8E8376D3E432A691785
SHA256:30CD92B1A545BAC3D43D6A85211774DB86CD3698B3AD14AF4FA03492575232BB
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\6.40.228.501_ru_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:AC213F43170D94E13EEDF1F9255B0A7D
SHA256:69D5F57700D379DADCDE41154D3BA2657CDE31236B618F638681B6A179D02EB5
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\7.21.4624.507_ja_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:7D765DD23B701030BBEB017EA9AC0CC7
SHA256:9F0E233A0EF18470A601F012EB27E0443605048A98F51EB6608D62F4335C8ACC
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\6.40.228.501_zh-CHS_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:8B55394EF97D3244811FD8C31CA5D83C
SHA256:EA7EA6C9425A2E909B33D5936998E90363B4E6CCD3576A004AFDF53CEADAA4BC
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\7.21.4624.507_es_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:BAC4BCB43B0DE2744DC6E25FBD872616
SHA256:9BA025AE63A6801AABBD5F300901A4B54ABCC1372B35AEE8D258C164EA7CA820
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\7.21.4624.507_de_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:2291BBEDB1BC3687A99419BED52838DF
SHA256:DCDCDB54E72F7290A272510D3C0F207DD5C87CB793D0A8969429D3460CB33E76
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\6.40.228.501_ja_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:58317EEC7F91BD585DFAC39B969F5D50
SHA256:A9A2506B2D472ECFD37EE4A52C8C89299BEB9AF59713D23FFBD30576E0B953C8
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\6.40.228.501_nl_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:0FA5447BDB5F6308AACD9C31D39E972B
SHA256:8FC06E3A8B8F40DD8FBF728FB124F21917BE0BEB465F47EC3536C9BA1DDB12A9
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\6.40.228.501_it_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:E597124A3D782ECF578BE56D938AAF35
SHA256:DFA8C1D48E81AEA54EDF1C00B7F6F796009FF9F6B15E64975AA4526D94C88E5E
3008CodeMeterRuntimeReduced.exeC:\Users\admin\AppData\Local\Temp\CodeMeter_v7.21.4624.507\Global Assembly Cache Folder\WibuCmNET.resources\7.21.4624.507_nl_01D86E1EB0C69C23\WibuCmNET.resources.dllexecutable
MD5:826A91E7CDA736F6B36A8FE0F00DB574
SHA256:7FEE8AF2FFC4D9298033A028BA3A9A24C8C507C741FF41C5B1D218438A5B7FE3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CodeMeterRuntimeReduced.exe