URL:

https://trickflag.info/pc.php?code=vad&q=Aimware%20CS2&source=22&s1=145658&s2=&s3=&s4=&s5=download-button-vad&click_id=MjJ8MTQ1NjU4fDB8V2luZG93c18xMHxGaXJlZm94fGF0dGhlbGFrZS5pbmZvfGFpbXdhcmVHaXR8MmEwMjoyZjA3OjQ3MDg6NGMwMDo5NDY0OjM4OWM6NTYxOmRjMmQ=&dt=1771109170&p=&tp2=&tpr=

Full analysis: https://app.any.run/tasks/ce253580-ea49-4050-bb83-a1a87ad39363
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 14, 2026, 22:46:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
adware
innosetup
inno
installer
delphi
loader
stealer
auto
offloader
websocket
advancedinstaller
generic
takemyfile
Indicators:
MD5:

EC2F4F61C4242CF29AC9EF636431C4CD

SHA1:

73F4885129D67DDF2A685C1F3FD48487C7105F03

SHA256:

32932513076B6545FAF1E0B1AD75451E9A9203D85C264BE3EF2957CC871745F1

SSDEEP:

6:2PXV7F2rX8XssFmu8CidqvNxjMlFTbfZur4hNaYaI:2PXlF4M8g04bAl1bhk4h7p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • INNOSETUP has been detected (SURICATA)

      • Aimware CS2.tmp (PID: 404)

    • Executing a file with an untrusted certificate

      • eld1.exe (PID: 5752)
      • eld5.exe (PID: 6792)

    • Actions looks like stealing of personal data

      • eld1.exe (PID: 5752)

    • Steals credentials from Web Browsers

      • eld1.exe (PID: 5752)

    • Changes powershell execution policy (Bypass)

      • eld1.exe (PID: 5752)

    • OFFLOADER has been found (auto)

      • Aimware CS2.tmp (PID: 404)

    • Changes the autorun value in the registry

      • VC_redist.x86.exe (PID: 3112)

    • Adds path to the Windows Defender exclusion list

      • eld3.exe (PID: 8652)
      • Droops.exe (PID: 8392)

    • Changes Windows Defender settings

      • eld3.exe (PID: 8652)
      • Droops.exe (PID: 8392)

    • GENERIC has been found (auto)

      • eld4.exe (PID: 6904)

    • Creates scheduled task from XML file

      • narcissist.exe (PID: 468)
      • narcissist.exe (PID: 6224)
      • narcissist.exe (PID: 3112)

    • Uses Task Scheduler to run other applications

      • narcissist.exe (PID: 6224)
      • narcissist.exe (PID: 468)
      • narcissist.exe (PID: 3112)

    • Create files in the Startup directory

      • Droops.exe (PID: 8392)

    • Creates a new scheduled task via Registry

      • msiexec.exe (PID: 2360)

    • ADVANCEDINSTALLER has been detected (SURICATA)

      • msiexec.exe (PID: 2480)

    • ADWARE has been detected (SURICATA)

      • msiexec.exe (PID: 2480)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Aimware CS2.exe (PID: 3544)
      • Aimware CS2.tmp (PID: 404)
      • Aimware CS2.exe (PID: 6580)
      • eld2.exe (PID: 1520)
      • eld2.tmp (PID: 1884)
      • vc_redist.x86.exe (PID: 1484)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 3112)
      • VC_redist.x86.exe (PID: 1676)
      • VC_redist.x86.exe (PID: 5520)
      • eld3.exe (PID: 8652)
      • Droops.exe (PID: 8392)
      • eld4.exe (PID: 6904)
      • narcissist.exe (PID: 468)
      • narcissist.exe (PID: 6224)
      • eld5.exe (PID: 6792)
      • narcissist.exe (PID: 3112)

    • Reads the Windows owner or organization settings

      • Aimware CS2.tmp (PID: 404)
      • eld2.tmp (PID: 1884)
      • msiexec.exe (PID: 2860)
      • eld5.exe (PID: 6792)

    • Access to an unwanted program domain was detected

      • Aimware CS2.tmp (PID: 404)
      • msiexec.exe (PID: 2480)

    • Searches for installed software

      • eld1.exe (PID: 5752)
      • vc_redist.x86.exe (PID: 5992)
      • dllhost.exe (PID: 8544)
      • VC_redist.x86.exe (PID: 1676)
      • VC_redist.x86.exe (PID: 5520)

    • Possible stealing from crypto wallets

      • eld1.exe (PID: 5752)

    • Possible stealing from browsers

      • eld1.exe (PID: 5752)

    • Possible stealing of email data

      • eld1.exe (PID: 5752)

    • Possible stealing of messenger data

      • eld1.exe (PID: 5752)

    • Possible stealing from password managers

      • eld1.exe (PID: 5752)

    • Found IP address in command line

      • powershell.exe (PID: 8264)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8264)

    • Starts POWERSHELL.EXE for commands execution

      • eld1.exe (PID: 5752)
      • eld3.exe (PID: 8652)
      • Droops.exe (PID: 8392)

    • The process bypasses the loading of PowerShell profile settings

      • eld1.exe (PID: 5752)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 8264)

    • Probably download files using WebClient

      • eld1.exe (PID: 5752)

    • Starts a Microsoft application from unusual location

      • vc_redist.x86.exe (PID: 1484)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 3112)

    • Process drops legitimate windows executable

      • eld2.tmp (PID: 1884)
      • vc_redist.x86.exe (PID: 1484)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 3112)
      • msiexec.exe (PID: 2860)
      • VC_redist.x86.exe (PID: 5520)
      • Droops.exe (PID: 8392)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)

    • Starts itself from another location

      • vc_redist.x86.exe (PID: 5992)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4472)
      • wscl.exe (PID: 4924)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 2860)

    • Application launched itself

      • VC_redist.x86.exe (PID: 5508)
      • VC_redist.x86.exe (PID: 1676)

    • Reads the date of Windows installation

      • SystemSettings.exe (PID: 7740)

    • Script adds exclusion path to Windows Defender

      • eld3.exe (PID: 8652)
      • Droops.exe (PID: 8392)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Droops.exe (PID: 8392)

    • The process executes via Task Scheduler

      • Knit.exe (PID: 272)
      • yawk.exe (PID: 5216)
      • Knit.exe (PID: 5804)
      • yawk.exe (PID: 6928)
      • yawk.exe (PID: 8820)

    • ADVANCEDINSTALLER mutex has been found

      • eld5.exe (PID: 6792)

    • Checks for Java to be installed

      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)

    • Uses TASKKILL.EXE to kill process

      • msiexec.exe (PID: 2480)

    • Probably fake Windows Update file has been dropped

      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 2860)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 2860)

    • Runs shell command (SCRIPT)

      • msiexec.exe (PID: 2480)

  • INFO

    • Drops script file

      • msedge.exe (PID: 8160)
      • powershell.exe (PID: 8264)
      • eld2.tmp (PID: 1884)
      • powershell.exe (PID: 3584)
      • powershell.exe (PID: 6036)
      • powershell.exe (PID: 8472)
      • powershell.exe (PID: 3112)
      • powershell.exe (PID: 4660)
      • powershell.exe (PID: 2944)

    • Checks supported languages

      • identity_helper.exe (PID: 6080)
      • Aimware CS2.exe (PID: 3544)
      • Aimware CS2.tmp (PID: 3944)
      • Aimware CS2.exe (PID: 6580)
      • Aimware CS2.tmp (PID: 404)
      • eld1.exe (PID: 5752)
      • eld2.exe (PID: 1520)
      • eld2.tmp (PID: 1884)
      • vc_redist.x86.exe (PID: 1484)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 3112)
      • msiexec.exe (PID: 2860)
      • VC_redist.x86.exe (PID: 1676)
      • VC_redist.x86.exe (PID: 5508)
      • VC_redist.x86.exe (PID: 5520)
      • eld3.exe (PID: 8652)
      • SystemSettings.exe (PID: 7740)
      • Droops.exe (PID: 8392)
      • eld4.exe (PID: 6904)
      • wscl.exe (PID: 4924)
      • Knit.exe (PID: 3192)
      • yawk.exe (PID: 2764)
      • narcissist.exe (PID: 468)
      • Knit.exe (PID: 272)
      • narcissist.exe (PID: 6224)
      • yawk.exe (PID: 5216)
      • eld5.exe (PID: 6792)
      • Knit.exe (PID: 8024)
      • Knit.exe (PID: 5804)
      • narcissist.exe (PID: 3112)
      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)
      • msiexec.exe (PID: 2360)
      • SecHealthUI.exe (PID: 1956)
      • yawk.exe (PID: 6928)
      • yawk.exe (PID: 8820)

    • Reads the computer name

      • identity_helper.exe (PID: 6080)
      • Aimware CS2.tmp (PID: 3944)
      • Aimware CS2.exe (PID: 6580)
      • Aimware CS2.tmp (PID: 404)
      • eld1.exe (PID: 5752)
      • eld2.exe (PID: 1520)
      • eld2.tmp (PID: 1884)
      • vc_redist.x86.exe (PID: 1484)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 3112)
      • msiexec.exe (PID: 2860)
      • VC_redist.x86.exe (PID: 1676)
      • VC_redist.x86.exe (PID: 5520)
      • eld3.exe (PID: 8652)
      • SystemSettings.exe (PID: 7740)
      • eld4.exe (PID: 6904)
      • wscl.exe (PID: 4924)
      • Knit.exe (PID: 3192)
      • yawk.exe (PID: 2764)
      • yawk.exe (PID: 5216)
      • Knit.exe (PID: 272)
      • Knit.exe (PID: 8024)
      • eld5.exe (PID: 6792)
      • Knit.exe (PID: 5804)
      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)
      • msiexec.exe (PID: 2360)
      • SecHealthUI.exe (PID: 1956)
      • yawk.exe (PID: 6928)
      • yawk.exe (PID: 8820)

    • Application launched itself

      • msedge.exe (PID: 7896)

    • Reads Environment values

      • identity_helper.exe (PID: 6080)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 2480)
      • msiexec.exe (PID: 4700)

    • The sample compiled with english language support

      • msedge.exe (PID: 7476)
      • msedge.exe (PID: 7896)
      • WinRAR.exe (PID: 7564)
      • vc_redist.x86.exe (PID: 5992)
      • vc_redist.x86.exe (PID: 1484)
      • eld2.tmp (PID: 1884)
      • VC_redist.x86.exe (PID: 3112)
      • msiexec.exe (PID: 2860)
      • VC_redist.x86.exe (PID: 1676)
      • VC_redist.x86.exe (PID: 5520)
      • eld3.exe (PID: 8652)
      • Aimware CS2.tmp (PID: 404)
      • Droops.exe (PID: 8392)
      • eld4.exe (PID: 6904)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7564)
      • msiexec.exe (PID: 2860)
      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)

    • Manual execution by a user

      • WinRAR.exe (PID: 7564)
      • Aimware CS2.exe (PID: 3544)
      • Taskmgr.exe (PID: 7940)
      • Taskmgr.exe (PID: 7656)
      • Taskmgr.exe (PID: 8648)
      • Taskmgr.exe (PID: 5780)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 7896)

    • Create files in a temporary directory

      • Aimware CS2.exe (PID: 3544)
      • Aimware CS2.tmp (PID: 404)
      • Aimware CS2.exe (PID: 6580)
      • eld2.exe (PID: 1520)
      • vc_redist.x86.exe (PID: 5992)
      • eld2.tmp (PID: 1884)
      • VC_redist.x86.exe (PID: 3112)
      • VC_redist.x86.exe (PID: 1676)
      • eld3.exe (PID: 8652)
      • Droops.exe (PID: 8392)
      • eld4.exe (PID: 6904)
      • narcissist.exe (PID: 6224)
      • narcissist.exe (PID: 468)
      • narcissist.exe (PID: 3112)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)

    • Reads security settings of Internet Explorer

      • Aimware CS2.tmp (PID: 3944)
      • Taskmgr.exe (PID: 7656)
      • Taskmgr.exe (PID: 5780)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 1676)
      • eld3.exe (PID: 8652)
      • eld4.exe (PID: 6904)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 2480)
      • SecHealthUI.exe (PID: 1956)

    • Process checks computer location settings

      • Aimware CS2.tmp (PID: 3944)
      • vc_redist.x86.exe (PID: 5992)
      • VC_redist.x86.exe (PID: 1676)
      • msiexec.exe (PID: 2480)

    • Checks proxy server information

      • slui.exe (PID: 2688)
      • Aimware CS2.tmp (PID: 404)
      • powershell.exe (PID: 8264)
      • eld3.exe (PID: 8652)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 2480)

    • Compiled with Borland Delphi (YARA)

      • Aimware CS2.exe (PID: 3544)
      • Aimware CS2.tmp (PID: 3944)
      • Aimware CS2.exe (PID: 6580)
      • Aimware CS2.tmp (PID: 404)
      • eld1.exe (PID: 5752)

    • Detects InnoSetup installer (YARA)

      • Aimware CS2.exe (PID: 3544)
      • Aimware CS2.exe (PID: 6580)
      • Aimware CS2.tmp (PID: 404)
      • eld1.exe (PID: 5752)
      • Aimware CS2.tmp (PID: 3944)

    • Reads the machine GUID from the registry

      • eld1.exe (PID: 5752)
      • VC_redist.x86.exe (PID: 3112)
      • msiexec.exe (PID: 2860)
      • SystemSettings.exe (PID: 7740)
      • Knit.exe (PID: 3192)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 2480)

    • Disables trace logs

      • powershell.exe (PID: 8264)

    • Creates files in the program directory

      • eld2.tmp (PID: 1884)
      • VC_redist.x86.exe (PID: 3112)
      • Droops.exe (PID: 8392)
      • Aimware CS2.tmp (PID: 404)
      • SystemSettings.exe (PID: 7740)
      • yawk.exe (PID: 2764)

    • Manages system restore points

      • SrTasks.exe (PID: 5012)

    • Creates a software uninstall entry

      • VC_redist.x86.exe (PID: 3112)
      • msiexec.exe (PID: 2860)
      • Aimware CS2.tmp (PID: 404)

    • Launching a file from a Registry key

      • VC_redist.x86.exe (PID: 3112)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2860)
      • eld2.tmp (PID: 1884)
      • eld3.exe (PID: 8652)
      • SystemSettings.exe (PID: 7740)
      • Droops.exe (PID: 8392)
      • eld5.exe (PID: 6792)
      • msiexec.exe (PID: 2480)

    • Creating file in SysWOW64

      • msiexec.exe (PID: 2860)

    • Failed to connect to remote server (POWERSHELL)

      • powershell.exe (PID: 8264)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8264)
      • powershell.exe (PID: 6036)
      • powershell.exe (PID: 3584)
      • powershell.exe (PID: 8472)
      • powershell.exe (PID: 3112)
      • powershell.exe (PID: 4660)
      • powershell.exe (PID: 2944)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6036)
      • powershell.exe (PID: 3584)
      • powershell.exe (PID: 8472)
      • powershell.exe (PID: 3112)
      • powershell.exe (PID: 4660)
      • powershell.exe (PID: 2944)

    • NirSoft software is detected

      • yawk.exe (PID: 2764)
      • yawk.exe (PID: 5216)
      • yawk.exe (PID: 6928)
      • yawk.exe (PID: 8820)

    • Launching a file from the Startup directory

      • Droops.exe (PID: 8392)

    • Reads Microsoft Office registry keys

      • msiexec.exe (PID: 4700)
      • msiexec.exe (PID: 2480)

    • Reads CPU info

      • SystemSettings.exe (PID: 7740)

    • Reads the time zone

      • SystemSettings.exe (PID: 7740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
295
Monitored processes
113
Malicious processes
13
Suspicious processes
9

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Knit.exe" "OsonahOsonatOsonatOsonapOsonasOsona:Osona/Osona/OsonawOsonawOsonawOsona.OsonagOsonaaOsonalOsonaaOsonaxOsonayOsonatOsonahOsonaeOsonarOsonaeOsona.OsonacOsonaoOsonamOsona/OsonacasahdapsjOsonamjepslatdrOsonacdejvaspiAOsonaIz5rYkr96cOsonaAeou564Ymmmwepequitugela"C:\Users\admin\AppData\Local\Knit.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
oyugo_5941
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\knit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
404"C:\Users\admin\AppData\Local\Temp\is-271BKPLX55.tmp\Aimware CS2.tmp" /SL5="$70400,893440,893440,C:\Users\admin\Downloads\Aimware CS2\Aimware CS2.exe" /SPAWNWND=$C03D0 /FIRSTWND=$130274 C:\Users\admin\AppData\Local\Temp\is-271BKPLX55.tmp\Aimware CS2.tmp
Aimware CS2.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-271bkplx55.tmp\aimware cs2.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
468C:\Users\admin\AppData\Local\Temp\nstCEBA.tmp\narcissist.exe "C:\Users\admin\AppData\Local\Temp\nstCEBA.tmp\KnitL"C:\Users\admin\AppData\Local\Temp\nstCEBA.tmp\narcissist.exe
Droops.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nstceba.tmp\narcissist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
552\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
792"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /fC:\Windows\SysWOW64\taskkill.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7232,i,906141049097859231,9022830928548166200,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1484"C:\Users\admin\AppData\Local\Temp\is-07L24KGT19.tmp\vc_redist.x86.exe" /install /quiet /norestartC:\Users\admin\AppData\Local\Temp\is-07L24KGT19.tmp\vc_redist.x86.exe
eld2.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ v14 Redistributable (x86) - 14.50.35710
Exit code:
0
Version:
14.50.35710.0
Modules
Images
c:\users\admin\appdata\local\temp\is-07l24kgt19.tmp\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1520"C:\Users\admin\AppData\Local\Temp\is-0WMKBLDB2V.tmp\eld2.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-0WMKBLDB2V.tmp\eld2.exe
Aimware CS2.tmp
User:
admin
Company:
Doc services Co.
Integrity Level:
HIGH
Description:
Docs Helper Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\is-0wmkbldb2v.tmp\eld2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1676"C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe" -burn.filehandle.attached=536 -burn.filehandle.self=556 -uninstall -quiet -burn.related.upgrade -burn.ancestors={3fdfb881-a139-4811-9788-61520be14e1f} -burn.filehandle.self=980 -burn.embedded BurnPipe.{534544F1-1A32-4DD0-8CEA-B598BB7C95A8} {CEAE4D40-4EC8-4657-A4F4-E1E21C4A2D81} 3112C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\VC_redist.x86.exe
VC_redist.x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532
Exit code:
0
Version:
14.36.32532.0
Modules
Images
c:\programdata\package cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
81 061
Read events
79 940
Write events
806
Delete events
315

Modification events

(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:12
Value:
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:11
Value:
(PID) Process:(7564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:10
Value:
Executable files
144
Suspicious files
161
Text files
507
Unknown types
42

Dropped files

PID
Process
Filename
Type
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1e55a0.TMP —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1e55bf.TMP —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1e55bf.TMP —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1e55bf.TMP —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1e55bf.TMP —
MD5:—
SHA256:—
7896msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
204
TCP/UDP connections
139
DNS requests
97
Threats
51

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7476
msedge.exe
GET
302
194.54.164.123:443
https://trickflag.info/pc.php?code=vad&q=Aimware%20CS2&source=22&s1=145658&s2=&s3=&s4=&s5=download-button-vad&click_id=MjJ8MTQ1NjU4fDB8V2luZG93c18xMHxGaXJlZm94fGF0dGhlbGFrZS5pbmZvfGFpbXdhcmVHaXR8MmEwMjoyZjA3OjQ3MDg6NGMwMDo5NDY0OjM4OWM6NTYxOmRjMmQ=&dt=1771109170&p=&tp2=&tpr=
SE
—
—
unknown
7476
msedge.exe
OPTIONS
200
35.190.80.1:443
https://a.nel.cloudflare.com/report/v4?s=sEMlCZ4gk9sASvGU5atSq%2Fo8put9JnQQ73q%2F%2FoVYADJa%2BmLUg8V3BZLAu8zVmCtqOvtIl1Gyd8fuV3XB2krCdMnSNShAafCpNhpfQvXqUxRKQheHNw4%3D
US
—
—
unknown
7476
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:b_NNFQ5HKqWZWbG5ud7-_Z8EStzVXW-tGnXUT_oo8KM&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
101 b
whitelisted
7476
msedge.exe
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=66&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0
US
text
4.47 Kb
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
959 b
whitelisted
7476
msedge.exe
GET
304
150.171.27.11:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
US
—
—
whitelisted
7476
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
US
—
446 b
whitelisted
7476
msedge.exe
GET
304
16.15.202.242:443
https://makfile.s3.us-east-1.amazonaws.com/6990fb42b70aa/Aimware%20CS2.html
US
—
—
unknown
7476
msedge.exe
GET
200
104.18.22.222:443
https://copilot.microsoft.com/c/api/user/eligibility
US
text
25 b
whitelisted
7476
msedge.exe
GET
200
13.107.246.44:443
https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US
US
—
82 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8124
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5660
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.204.148:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7476
msedge.exe
150.171.22.17:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
whitelisted
self.events.data.microsoft.com
  • 104.208.16.88
  • 13.89.179.9
whitelisted
www.bing.com
  • 2.16.204.148
  • 2.16.204.155
  • 2.16.204.135
  • 2.16.204.160
  • 2.16.204.158
  • 2.16.204.141
  • 2.16.204.138
  • 2.16.204.134
  • 2.16.204.161
  • 2.16.241.218
  • 2.16.241.201
whitelisted
ocsp.digicert.com
  • 23.63.118.230
  • 184.30.131.245
whitelisted
google.com
  • 142.251.208.174
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
trickflag.info
  • 194.54.164.123
unknown

Threats

PID
Process
Class
Message
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6768
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
404
Aimware CS2.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
404
Aimware CS2.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
404
Aimware CS2.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
Process
Message
Knit.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://trickflag.info/pc.php?code=vad&q=Aimware%20CS2&source=22&s1=145658&s2=&s3=&s4=&s5=download-button-vad&click_id=MjJ8MTQ1NjU4fDB8V2luZG93c18xMHxGaXJlZm94fGF0dGhlbGFrZS5pbmZvfGFpbXdhcmVHaXR8MmEwMjoyZjA3OjQ3MDg6NGMwMDo5NDY0OjM4OWM6NTYxOmRjMmQ=&dt=1771109170&p=&tp2=&tpr=