File name:

AutoHotkey_1.1.37.02_setup.exe

Full analysis: https://app.any.run/tasks/82579b58-bfd0-419c-9b43-b01e77880acb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 26, 2025, 15:34:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ahk
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

C2E8062052BB2B25D4951B78BA9A5E73

SHA1:

947DBF6343D632FC622CC2920D0AD303C32FCC80

SHA256:

49A48E879F7480238D2FE17520AC19AFE83685AAC0B886719F9E1EAC818B75CC

SSDEEP:

98304:qruJDQ7RokGnq/yHXrgVQHFUCacKc/Gn9CtJFek03iMzwsIWdMw9jglAUuna6Syo:PDPM49zQi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AHK has been detected (YARA)

      • setup.exe (PID: 7492)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • setup.exe (PID: 7492)
      • hh.exe (PID: 812)

    • Executable content was dropped or overwritten

      • AutoHotkey_1.1.37.02_setup.exe (PID: 7456)
      • setup.exe (PID: 7492)

    • Reads Internet Explorer settings

      • setup.exe (PID: 7492)
      • hh.exe (PID: 812)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 7492)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 7492)

    • Creates a software uninstall entry

      • setup.exe (PID: 7492)

    • Application launched itself

      • AutoHotkey.exe (PID: 5116)

  • INFO

    • Checks supported languages

      • AutoHotkey_1.1.37.02_setup.exe (PID: 7456)
      • setup.exe (PID: 7492)
      • AutoHotkey.exe (PID: 5116)
      • AutoHotkey.exe (PID: 7224)

    • The sample compiled with english language support

      • AutoHotkey_1.1.37.02_setup.exe (PID: 7456)
      • setup.exe (PID: 7492)

    • Reads the computer name

      • setup.exe (PID: 7492)
      • AutoHotkey.exe (PID: 5116)

    • Create files in a temporary directory

      • AutoHotkey_1.1.37.02_setup.exe (PID: 7456)
      • hh.exe (PID: 812)

    • Process checks whether UAC notifications are on

      • setup.exe (PID: 7492)
      • AutoHotkey.exe (PID: 5116)

    • Checks proxy server information

      • setup.exe (PID: 7492)
      • hh.exe (PID: 812)

    • Detects AutoHotkey samples (YARA)

      • AutoHotkey_1.1.37.02_setup.exe (PID: 7456)
      • setup.exe (PID: 7492)

    • Creates files in the program directory

      • setup.exe (PID: 7492)

    • Manual execution by a user

      • AutoHotkey.exe (PID: 5116)

    • AutoHotkey executable

      • AutoHotkey.exe (PID: 5116)

    • Reads security settings of Internet Explorer

      • hh.exe (PID: 812)

    • Creates files or folders in the user directory

      • hh.exe (PID: 812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 18:41:55+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 22016
InitializedDataSize: 33792
UninitializedDataSize: -
EntryPoint: 0x643f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.37.2
ProductVersionNumber: 1.1.37.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: AutoHotkey Setup
FileVersion: 1.1.37.02
ProductName: AutoHotkey
ProductVersion: 1.1.37.02
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start autohotkey_1.1.37.02_setup.exe #AHK setup.exe sppextcomobj.exe no specs slui.exe no specs autohotkey.exe no specs autohotkey.exe no specs hh.exe no specs autohotkey_1.1.37.02_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
812"hh.exe" "ms-its:AutoHotkey.chm::/docs/Welcome.htm"C:\Windows\SysWOW64\hh.exe—AutoHotkey.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\hh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5116"C:\Program Files\AutoHotkey\AutoHotkey.exe" "C:\Program Files\AutoHotkey\Installer.ahk" /exec runahkC:\Program Files\AutoHotkey\AutoHotkey.exe—explorer.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey ANSI 32-bit
Exit code:
0
Version:
1.1.37.02
Modules
Images
c:\program files\autohotkey\autohotkey.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7224AutoHotkey.exeC:\Program Files\AutoHotkey\AutoHotkey.exe—AutoHotkey.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey ANSI 32-bit
Exit code:
2
Version:
1.1.37.02
Modules
Images
c:\program files\autohotkey\autohotkey.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7324"C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe" C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Setup
Exit code:
3221226540
Version:
1.1.37.02
Modules
Images
c:\users\admin\appdata\local\temp\autohotkey_1.1.37.02_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7456"C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe" C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
AutoHotkey Setup
Version:
1.1.37.02
Modules
Images
c:\users\admin\appdata\local\temp\autohotkey_1.1.37.02_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7492C:\Users\admin\AppData\Local\Temp\7z0DA94D20\setup.exe C:\Users\admin\AppData\Local\Temp\7z0DA94D20\setup.exe
AutoHotkey_1.1.37.02_setup.exe
User:
admin
Integrity Level:
HIGH
Version:
1.1.37.02
Modules
Images
c:\users\admin\appdata\local\temp\7z0da94d20\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7592C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7624"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 854
Read events
1 836
Write events
18
Delete events
0

Modification events

(PID) Process:(7492) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7492) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7492) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AutoHotkey
Operation:writeName:InstallDir
Value:
C:\Program Files\AutoHotkey
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AutoHotkey
Operation:writeName:Version
Value:
1.1.37.02
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AutoHotkey
Operation:writeName:StartMenuFolder
Value:
AutoHotkey
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ahk\ShellNew
Operation:writeName:FileName
Value:
Template.ahk
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs
Operation:writeName:HasLUAShield
Value:
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayName
Value:
AutoHotkey 1.1.37.02
(PID) Process:(7492) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:UninstallString
Value:
"C:\Program Files\AutoHotkey\AutoHotkey.exe" "C:\Program Files\AutoHotkey\Installer.ahk"
Executable files
17
Suspicious files
14
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\AutoHotkey.chmbinary
MD5:17D5E275DBC8278D888F7DA1D681D7E3
SHA256:DE37A93068CA25701B3413EAB0F01FA1646D2DAB0346D78494192E95D94AD521
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\Compiler\Ahk2Exe.exeexecutable
MD5:78515B1091F74C0F828AED92D3C972B0
SHA256:754A28ED76A7B4EBA7909B146CFC4C4C2AA43AFF54E10A5CD6DBC939C0732B6A
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\Compiler\Unicode 64-bit.binexecutable
MD5:30DA2DF436169D6F09732E61D8849A05
SHA256:6E7C9AE1DAABDB958A4D9C8E7297BA956C9504B5F76CE61FC31281F5BB0B0B55
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\Compiler\ANSI 32-bit.binexecutable
MD5:31ED560D3EDC5F1EEA515C4358B90406
SHA256:F5A5C05BF0FEDCC451ADE5676A5647E828A6F08CF6C21970E6C035F4311B5A3C
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\AutoHotkeyA32.exeexecutable
MD5:FD94B77958305A1AC3EEAC27EE765256
SHA256:6A98B438B67DA7316E9251EB1A92CD5384A8349D239A77903F7282FA076A77C3
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\setup.exeexecutable
MD5:B98EE9E00B5546763F9C6E65E436F6E6
SHA256:6D876C526B5CBC5DC5341C1011B1C91639597F46677A1D42426F4A52DFEA6756
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\Compiler\Unicode 32-bit.binexecutable
MD5:DB213C2DC5D0F542A1E925F09C021E05
SHA256:2D193510B56FBDB8530F8DED2F1C9FB982DF971DCA5FAD1F24F558BE16A4F804
7456AutoHotkey_1.1.37.02_setup.exeC:\Users\admin\AppData\Local\Temp\7z0DA94D20\license.txttext
MD5:E3F2AD7733F3166FE770E4DC00AF6C45
SHA256:B27C1A7C92686E47F8740850AD24877A50BE23FD3DBD44EDEE50AC1223135E38
7492setup.exeC:\Program Files\AutoHotkey\AutoHotkeyU32.exeexecutable
MD5:B6AF97AA32C636C3C4E87BB768A3CEB7
SHA256:BA35B8B4346B79B8BB4F97360025CB6BEFAF501B03149A3B5FEF8F07BDF265C7
7492setup.exeC:\Program Files\AutoHotkey\WindowSpy.ahktext
MD5:32020E55548B1E9E7CE22899617D5CD2
SHA256:4688629BE394986C8DBE6517032429E6E8CDD9F5801DDB1AC1F53E6FE86EEE7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.251.198:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
92.122.244.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8052
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8052
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2568
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
92.122.244.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.89.217:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 92.122.244.42
  • 92.122.244.32
whitelisted
www.microsoft.com
  • 95.101.89.217
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.160.130
  • 20.190.160.20
  • 20.190.160.2
  • 40.126.32.134
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 23.54.251.198
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 20.3.187.198
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoHotkey_1.1.37.02_setup.exe