File name:

InstallPack.zip

Full analysis: https://app.any.run/tasks/fd39c2de-8c8b-419e-9793-8ad32f687bcc
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 20, 2024, 05:45:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
loader
lumma
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

0B6331FF01312A6A7DCB603398355C10

SHA1:

429E2C3ED3EAA4186D1B23221BBC34C9EB335C7B

SHA256:

471CF9C295B0BA5AC8404B8774F60CDBA4C96D9CB5DA6A4BAEAC3E72926AABCA

SSDEEP:

98304:S/ZJjrVED3mjT9gcxXVXRs8Co5tTaIz1snscfBsT08vmeFi88FdsI9ZYL0pXIvTm:aWtzA9/3pObYx9RD8gSoZPRacQoj8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • LUMMA mutex has been found

      • RegAsm.exe (PID: 3060)
      • RegAsm.exe (PID: 4996)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 3060)
      • RegAsm.exe (PID: 4996)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 4996)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3680)

    • Starts a Microsoft application from unusual location

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • Uses .NET C# to load dll

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 628)
      • csc.exe (PID: 3876)

    • Potential Corporate Privacy Violation

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • Connects to the server without a host name

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • Process requests binary or script from the Internet

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3680)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3680)

    • Reads the computer name

      • Install.exe (PID: 6256)

    • Manual execution by a user

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • Checks supported languages

      • Install.exe (PID: 6256)
      • csc.exe (PID: 628)
      • cvtres.exe (PID: 520)
      • RegAsm.exe (PID: 3060)
      • Install.exe (PID: 5728)
      • csc.exe (PID: 3876)
      • cvtres.exe (PID: 5964)
      • RegAsm.exe (PID: 4996)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3680)

    • Reads the machine GUID from the registry

      • Install.exe (PID: 6256)
      • csc.exe (PID: 628)
      • csc.exe (PID: 3876)

    • Disables trace logs

      • Install.exe (PID: 6256)
      • Install.exe (PID: 5728)

    • Create files in a temporary directory

      • Install.exe (PID: 6256)
      • csc.exe (PID: 628)
      • cvtres.exe (PID: 520)
      • cvtres.exe (PID: 5964)
      • csc.exe (PID: 3876)

    • Reads the software policy settings

      • RegAsm.exe (PID: 3060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:12:02 04:59:12
ZipCRC: 0x5a6a66ef
ZipCompressedSize: 79547
ZipUncompressedSize: 206304
ZipFileName: Install.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe install.exe csc.exe conhost.exe no specs cvtres.exe no specs regasm.exe no specs regasm.exe no specs #LUMMA regasm.exe install.exe csc.exe conhost.exe no specs cvtres.exe no specs #LUMMA regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
520C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES105A.tmp" "c:\Users\admin\AppData\Local\Temp\CSC45B4EA52B8A94911B2B5F9465AD119F9.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
628"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\0fw5infk.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2928"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3060"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3680"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\InstallPack.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3876"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\jr1ccnjv.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4716"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4996"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5728"C:\Users\admin\Desktop\Install.exe" C:\Users\admin\Desktop\Install.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
OLE/COM Object Viewer
Exit code:
3221225547
Version:
10.0.19041.685 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 078
Read events
6 971
Write events
90
Delete events
17

Modification events

(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\InstallPack.zip
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(3680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
8
Suspicious files
4
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
520cvtres.exeC:\Users\admin\AppData\Local\Temp\RES105A.tmpbinary
MD5:D82C1C9EBB10AF647C30BC8B18AFB9E8
SHA256:A5296EC6EBD54D5E3516353D5CEF6541D59885FB882A8CB76CDDC4A3F993382C
3680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3680.35432\Install.exeexecutable
MD5:2696D944FFBEF69510B0C826446FD748
SHA256:A4F53964CDDDCCCBD1B46DA4D3F7F5F4292B5DD11C833D3DB3A1E7DEF36DA69A
3680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3680.35432\files\vstdlib.dllexecutable
MD5:866E49FC80C2B7500334A716B177AFAD
SHA256:F8CE56BA4D4A0A8C1192D31736B4420EFE0B8EFCDB39805203E0344F290B3B04
3680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3680.35432\files\lilbcef.dllexecutable
MD5:60BE2CEC0D95BB135D4452F39AAC6805
SHA256:391B7E66004D7845F5CAA7D70F106DAC7D0B49538954C55601ED7B5985C3D699
6256Install.exeC:\Users\admin\AppData\Local\Temp\0fw5infk.0.cstext
MD5:B022C6FE4494666C8337A975D175C726
SHA256:D02016A307B3E8DA1A80C29551D44C17358910816E992BC1B53DA006D62DD56A
6256Install.exeC:\Users\admin\AppData\Local\Temp\0fw5infk.cmdlinetext
MD5:96F4F0B91BF89AE80DD3B00DCB675E14
SHA256:285F4F427136B79CE0ED18D9B1102A31A8C3698E752DE146987CAF8428B66420
3680WinRAR.exeC:\Users\admin\AppData\Local\Temp\InstallPack\Install.exeexecutable
MD5:2696D944FFBEF69510B0C826446FD748
SHA256:A4F53964CDDDCCCBD1B46DA4D3F7F5F4292B5DD11C833D3DB3A1E7DEF36DA69A
3680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3680.35432\iewers.dllexecutable
MD5:7A1F330D4D54B5259EB06A0E4E6D8E95
SHA256:909B3E941DCD16485EB0D4518145E7B27423EB0C323CF2666151AF0076776611
3680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3680.35432\files\vgui1.dllexecutable
MD5:528980B57BFC8C9B4B1F4CCD6463C8E0
SHA256:5ED6B4B10317EA24F41E4B825FD68BB09DC16C301C7267B0B355656F88B112B6
628csc.exeC:\Users\admin\AppData\Local\Temp\CSC45B4EA52B8A94911B2B5F9465AD119F9.TMPbinary
MD5:52568F5CA7F49B0FBF5C7EC2A92F5927
SHA256:E247EB4B1F74B3C5492BA00283620CB19F0719087FDDDD8B0DB8CC1A4F06AE77
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
44
DNS requests
16
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7028
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7028
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5728
Install.exe
GET
200
147.45.44.131:80
http://147.45.44.131/infopage/bghlj.exe
unknown
—
—
malicious
6256
Install.exe
GET
200
147.45.44.131:80
http://147.45.44.131/infopage/bghlj.exe
unknown
—
—
malicious
6696
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
104.126.37.179:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1200
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1468
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.179
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.186
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.14
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
6256
Install.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6256
Install.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6256
Install.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6256
Install.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5728
Install.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5728
Install.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5728
Install.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5728
Install.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
InstallPack.zip