File name:

siinst_1.6.exe

Full analysis: https://app.any.run/tasks/bcb5cff3-9e68-4a89-b072-a8d9326e65b9
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 29, 2024, 09:57:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

EDF832CCB00AD7509A553E1DF5A2828F

SHA1:

03DC1474DFB915048843F1859B5347551B65C2CC

SHA256:

4B2732DC1FA3A8C6282E3E58C0146BFB4A042602507304C666FEB034B7804FE3

SSDEEP:

98304:I+cD4dna8tBwrB+LxJ69uG+4JALUU1d/B/W4DvzU3Sz2goiufu1egvlne3+8/UwQ:xw6XzIPBQubOipQfbD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • siinst_1.6.tmp (PID: 6608)

    • Changes the autorun value in the registry

      • siinst_1.6.tmp (PID: 6608)

    • Actions looks like stealing of personal data

      • softinfo.exe (PID: 4764)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • siinst_1.6.tmp (PID: 6296)
      • softinfo.exe (PID: 7148)
      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 5316)
      • softinfo.exe (PID: 1988)
      • softinfo.exe (PID: 2324)
      • softinfo.exe (PID: 6088)
      • softinfo.exe (PID: 5936)
      • softinfo.exe (PID: 4984)
      • softinfo.exe (PID: 3952)
      • softinfo.exe (PID: 1216)
      • softinfo.exe (PID: 4388)
      • softinfo.exe (PID: 1476)
      • softinfo.exe (PID: 8140)
      • softinfo.exe (PID: 5696)
      • softinfo.exe (PID: 6924)
      • softinfo.exe (PID: 8012)

    • Executable content was dropped or overwritten

      • siinst_1.6.exe (PID: 6232)
      • siinst_1.6.exe (PID: 6476)
      • siinst_1.6.tmp (PID: 6608)
      • tmpE7B5.exe (PID: 1344)
      • tmpE7B5.tmp (PID: 6156)
      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 8012)

    • Reads the Windows owner or organization settings

      • siinst_1.6.tmp (PID: 6608)
      • tmpE7B5.tmp (PID: 6156)

    • Process drops legitimate windows executable

      • siinst_1.6.tmp (PID: 6608)
      • tmpE7B5.tmp (PID: 6156)

    • The process drops C-runtime libraries

      • siinst_1.6.tmp (PID: 6608)

    • Changes Internet Explorer settings (feature browser emulation)

      • siinst_1.6.tmp (PID: 6608)

    • Checks Windows Trust Settings

      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 7148)

    • Creates file in the systems drive root

      • siinst_1.6.tmp (PID: 6608)

    • Adds/modifies Windows certificates

      • softinfo.exe (PID: 7148)

    • Searches for installed software

      • softinfo.exe (PID: 4764)

    • Application launched itself

      • softinfo.exe (PID: 4764)

    • Reads Microsoft Outlook installation path

      • softinfo.exe (PID: 4764)

    • Reads the date of Windows installation

      • softinfo.exe (PID: 4764)

    • Executes application which crashes

      • softinfo.exe (PID: 4388)
      • softinfo.exe (PID: 1476)
      • softinfo.exe (PID: 5696)
      • softinfo.exe (PID: 6924)
      • softinfo.exe (PID: 8012)
      • softinfo.exe (PID: 8140)

  • INFO

    • Checks supported languages

      • siinst_1.6.tmp (PID: 6296)
      • siinst_1.6.exe (PID: 6232)
      • siinst_1.6.exe (PID: 6476)
      • siinst_1.6.tmp (PID: 6608)
      • softinfo.exe (PID: 7148)
      • softinfo.exe (PID: 4764)
      • tmpE7B5.tmp (PID: 6156)
      • tmpE7B5.exe (PID: 1344)
      • softinfo.exe (PID: 1988)
      • softinfo.exe (PID: 2324)
      • softinfo.exe (PID: 4984)
      • softinfo.exe (PID: 6088)
      • softinfo.exe (PID: 5316)
      • softinfo.exe (PID: 5936)
      • softinfo.exe (PID: 3952)
      • softinfo.exe (PID: 4388)
      • softinfo.exe (PID: 1216)
      • identity_helper.exe (PID: 8072)
      • softinfo.exe (PID: 1476)
      • softinfo.exe (PID: 8140)
      • softinfo.exe (PID: 5696)
      • softinfo.exe (PID: 6924)
      • softinfo.exe (PID: 8012)

    • Create files in a temporary directory

      • siinst_1.6.exe (PID: 6232)
      • siinst_1.6.exe (PID: 6476)
      • siinst_1.6.tmp (PID: 6608)
      • softinfo.exe (PID: 4764)
      • tmpE7B5.exe (PID: 1344)
      • tmpE7B5.tmp (PID: 6156)

    • Process checks computer location settings

      • siinst_1.6.tmp (PID: 6296)
      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 4984)
      • softinfo.exe (PID: 5316)
      • softinfo.exe (PID: 6088)
      • softinfo.exe (PID: 1216)

    • Reads the computer name

      • siinst_1.6.tmp (PID: 6296)
      • siinst_1.6.tmp (PID: 6608)
      • softinfo.exe (PID: 7148)
      • softinfo.exe (PID: 4764)
      • tmpE7B5.tmp (PID: 6156)
      • softinfo.exe (PID: 2324)
      • softinfo.exe (PID: 1988)
      • softinfo.exe (PID: 5316)
      • softinfo.exe (PID: 6088)
      • softinfo.exe (PID: 4984)
      • softinfo.exe (PID: 5936)
      • softinfo.exe (PID: 3952)
      • softinfo.exe (PID: 1216)
      • softinfo.exe (PID: 4388)
      • softinfo.exe (PID: 1476)
      • softinfo.exe (PID: 8140)
      • identity_helper.exe (PID: 8072)
      • softinfo.exe (PID: 5696)
      • softinfo.exe (PID: 6924)
      • softinfo.exe (PID: 8012)

    • Creates files in the program directory

      • siinst_1.6.tmp (PID: 6608)
      • softinfo.exe (PID: 7148)
      • tmpE7B5.tmp (PID: 6156)

    • The sample compiled with english language support

      • siinst_1.6.tmp (PID: 6608)
      • tmpE7B5.tmp (PID: 6156)
      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 8012)

    • Creates files or folders in the user directory

      • siinst_1.6.tmp (PID: 6608)
      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 7148)
      • softinfo.exe (PID: 1988)
      • WerFault.exe (PID: 2072)
      • WerFault.exe (PID: 6804)
      • WerFault.exe (PID: 5992)
      • WerFault.exe (PID: 4120)
      • WerFault.exe (PID: 4472)
      • WerFault.exe (PID: 6900)

    • Checks proxy server information

      • softinfo.exe (PID: 7148)
      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 1988)
      • softinfo.exe (PID: 5316)
      • softinfo.exe (PID: 2324)
      • softinfo.exe (PID: 6088)
      • softinfo.exe (PID: 5936)
      • softinfo.exe (PID: 4984)
      • softinfo.exe (PID: 3952)
      • softinfo.exe (PID: 1216)
      • softinfo.exe (PID: 4388)
      • softinfo.exe (PID: 1476)
      • softinfo.exe (PID: 8140)
      • softinfo.exe (PID: 5696)
      • softinfo.exe (PID: 6924)
      • softinfo.exe (PID: 8012)

    • Reads CPU info

      • softinfo.exe (PID: 7148)

    • Sends debugging messages

      • softinfo.exe (PID: 7148)

    • Reads the machine GUID from the registry

      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 7148)

    • Creates a software uninstall entry

      • siinst_1.6.tmp (PID: 6608)

    • Reads the time zone

      • softinfo.exe (PID: 7148)

    • Reads the software policy settings

      • softinfo.exe (PID: 4764)
      • softinfo.exe (PID: 7148)

    • Application launched itself

      • msedge.exe (PID: 776)
      • msedge.exe (PID: 7404)

    • The process uses the downloaded file

      • softinfo.exe (PID: 4764)

    • Reads Environment values

      • identity_helper.exe (PID: 8072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.6.1417.0
ProductVersionNumber: 1.6.1417.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Informer Technologies, Inc.
FileDescription: Software Informer Setup
FileVersion: 1.6.1417.0
LegalCopyright: © Informer Technologies, Inc 2007-2023
OriginalFileName:
ProductName: Software Informer
ProductVersion: 1.6.1417.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
220
Monitored processes
77
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start siinst_1.6.exe siinst_1.6.tmp no specs siinst_1.6.exe siinst_1.6.tmp softinfo.exe schtasks.exe no specs conhost.exe no specs softinfo.exe tmpe7b5.exe tmpe7b5.tmp softinfo.exe no specs softinfo.exe softinfo.exe no specs softinfo.exe no specs softinfo.exe no specs softinfo.exe no specs softinfo.exe no specs softinfo.exe no specs softinfo.exe werfault.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs softinfo.exe werfault.exe no specs msedge.exe no specs softinfo.exe werfault.exe no specs msedge.exe no specs msedge.exe no specs softinfo.exe werfault.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs softinfo.exe werfault.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs softinfo.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
776"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://opera.software.informer.com/download/?login=119677884&pwd=3f703670e3193ba52afa0d05a113886fC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
softinfo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
880"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4200 --field-trial-handle=2460,i,8195713910375176992,11958541331523074384,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
900"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2460,i,8195713910375176992,11958541331523074384,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1216"C:\Program Files\Software Informer\softinfo.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; CEF/3.2272.2035) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 SoftwareInformer/1.6.1417" --enable-chrome-runtime --user-data-dir="C:\Users\admin\AppData\Roaming\Software Informer\WbaCache\CEF" --log-severity=disable --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5156,i,14184916232160480581,17616124028235977774,262144 --disable-features=EnableHangWatcher --variations-seed-version --enable-logging=handle --log-file=5308 --mojo-platform-channel-handle=5300 /prefetch:1C:\Program Files\Software Informer\softinfo.exe—softinfo.exe
User:
admin
Company:
Informer Technologies, Inc.
Integrity Level:
MEDIUM
Description:
Software Informer
Version:
1.6.1417.0
Modules
Images
c:\program files\software informer\softinfo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
1344"C:\Users\admin\AppData\Local\Temp\tmpE7B5.exe" /verysilent /dir "C:\Program Files\Software Informer\cef"C:\Users\admin\AppData\Local\Temp\tmpE7B5.exe
softinfo.exe
User:
admin
Company:
Informer Technologies, Inc.
Integrity Level:
HIGH
Description:
Software Informer components Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\tmpe7b5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2460,i,8195713910375176992,11958541331523074384,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1476"C:\Program Files\Software Informer\softinfo.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; CEF/3.2272.2035) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 SoftwareInformer/1.6.1417" --enable-chrome-runtime --user-data-dir="C:\Users\admin\AppData\Roaming\Software Informer\WbaCache\CEF" --log-severity=disable --field-trial-handle=3532,i,14184916232160480581,17616124028235977774,262144 --disable-features=EnableHangWatcher --variations-seed-version --enable-logging=handle --log-file=5940 --mojo-platform-channel-handle=5748 /prefetch:8C:\Program Files\Software Informer\softinfo.exe
softinfo.exe
User:
admin
Company:
Informer Technologies, Inc.
Integrity Level:
MEDIUM
Description:
Software Informer
Exit code:
0
Version:
1.6.1417.0
1616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2664 --field-trial-handle=2464,i,15453339642241449486,7928669473507771193,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1796"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2548 --field-trial-handle=2464,i,15453339642241449486,7928669473507771193,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1988"C:\Program Files\Software Informer\softinfo.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; CEF/3.2272.2035) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 SoftwareInformer/1.6.1417" --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\admin\AppData\Roaming\Software Informer\WbaCache\CEF" --log-severity=disable --field-trial-handle=3404,i,14184916232160480581,17616124028235977774,262144 --disable-features=EnableHangWatcher --variations-seed-version --enable-logging=handle --log-file=3428 --mojo-platform-channel-handle=3424 /prefetch:3C:\Program Files\Software Informer\softinfo.exe
softinfo.exe
User:
admin
Company:
Informer Technologies, Inc.
Integrity Level:
MEDIUM
Description:
Software Informer
Version:
1.6.1417.0
Modules
Images
c:\program files\software informer\softinfo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
32 180
Read events
32 078
Write events
91
Delete events
11

Modification events

(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Informer Technologies, Inc.\Software Informer
Operation:writeName:Path
Value:
C:\Program Files\Software Informer
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Informer Technologies, Inc.\Software Informer\Settings
Operation:writeName:DisablePUL
Value:
0
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Software Informer
Value:
"C:\Program Files\Software Informer\softinfo.exe" -autorun
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:fsm
Value:
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\softinfo.exe
Operation:writeName:DumpFolder
Value:
C:\Users\admin\AppData\Roaming\Software Informer\WerDumps
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\softinfo.exe
Operation:writeName:DumpCount
Value:
3
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:softinfo.exe
Value:
11000
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING
Operation:writeName:softinfo.exe
Value:
0
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING
Operation:writeName:softinfo.exe
Value:
0
(PID) Process:(6608) siinst_1.6.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Informer Technologies, Inc.\Software Informer
Operation:delete valueName:WBA
Value:
Executable files
157
Suspicious files
733
Text files
390
Unknown types
258

Dropped files

PID
Process
Filename
Type
6232siinst_1.6.exeC:\Users\admin\AppData\Local\Temp\is-O482O.tmp\siinst_1.6.tmpexecutable
MD5:9D073EC958F33F1AE2C8DD66F0731D8C
SHA256:3BFB623406736B65E8212416F4FEA30B41888A6E895AC1366C33789DC2C0A904
6608siinst_1.6.tmpC:\Program Files\Software Informer\core.dllexecutable
MD5:9196B6F076FA0A2EE86EA9C63C10A952
SHA256:EB153765CBF7F54D76DE62CD1C8436551DE1D7566A69A8FF1B1A817CC4D415B9
6608siinst_1.6.tmpC:\Program Files\Software Informer\is-CI6P3.tmpexecutable
MD5:9D073EC958F33F1AE2C8DD66F0731D8C
SHA256:3BFB623406736B65E8212416F4FEA30B41888A6E895AC1366C33789DC2C0A904
6608siinst_1.6.tmpC:\Users\admin\AppData\Local\Temp\is-A8QN9.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6608siinst_1.6.tmpC:\Program Files\Software Informer\is-915LK.tmpexecutable
MD5:379682E8A34401BC731A69EBD6FE7276
SHA256:51506A4A0B5220C393E5B701F37B9B7E80DB1146D5B448E5CB7F98E45C36E079
6476siinst_1.6.exeC:\Users\admin\AppData\Local\Temp\is-58EJQ.tmp\siinst_1.6.tmpexecutable
MD5:9D073EC958F33F1AE2C8DD66F0731D8C
SHA256:3BFB623406736B65E8212416F4FEA30B41888A6E895AC1366C33789DC2C0A904
6608siinst_1.6.tmpC:\Users\admin\AppData\Local\Temp\is-A8QN9.tmp\InstallHelper.dllexecutable
MD5:5D8BF5012AC8102697BBB2B516A0E0BE
SHA256:4942A10138BEBB96901CFFE3E8C78639CC55939CB035C60C9643397E543C945D
6608siinst_1.6.tmpC:\Program Files\Software Informer\is-5M1QR.tmpexecutable
MD5:AEF889A3791C4BD62F77EBB570180D51
SHA256:1072F874AD5AA23C86AF312D3F9BA66C9021A25378914D1844820E290C693BCF
6608siinst_1.6.tmpC:\Program Files\Software Informer\unins000.exeexecutable
MD5:9D073EC958F33F1AE2C8DD66F0731D8C
SHA256:3BFB623406736B65E8212416F4FEA30B41888A6E895AC1366C33789DC2C0A904
6608siinst_1.6.tmpC:\Program Files\Software Informer\is-U26J1.tmpexecutable
MD5:BC47DB6003518F531AC5628F131F3D2F
SHA256:264A170A731D234C5A5337F5AAF3B3BBDB82CD5A7F5944AB58FCE3B477C5E6D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
120
TCP/UDP connections
152
DNS requests
136
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1596
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1596
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2164
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7136
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7136
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.72.205.209:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1596
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1596
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.72.205.209:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.165:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.72.205.209
  • 20.49.150.241
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
www.bing.com
  • 2.23.209.165
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.140
  • 104.126.37.146
  • 104.126.37.145
  • 104.126.37.136
  • 104.126.37.130
  • 104.126.37.129
  • 104.126.37.137
  • 104.126.37.179
  • 104.126.37.139
  • 104.126.37.185
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.72
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
siinst_1.6.exe