File name:

K-Pacs Installer V1.6.0 English.exe

Full analysis: https://app.any.run/tasks/6c4a9f39-1720-404f-8d3a-21fb82c653bf
Verdict: Malicious activity
Analysis date: March 13, 2025, 14:11:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections
MD5:

4ACD7DF0A52701F962C5B799504DEDD4

SHA1:

B3BDF037F657F3D8BD8C26735707D4C9EEA7021A

SHA256:

5342831C0B2B50D93F558B167B5962E3E422FC43EE93E8A03DE0B2BF2CD324D9

SSDEEP:

98304:pjXPcdpTu9NqynZUz3GGysmLd/MusPLUHhYvo6kaM9ibRHcjNCJknx3VhhxTIlwv:nlmug7sRG/SJF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Reads Internet Explorer settings

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Reads Microsoft Outlook installation path

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Executable content was dropped or overwritten

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • Starts CMD.EXE for commands execution

      • Install-Eng.exe (PID: 8052)

    • Executing commands from a ".bat" file

      • Install-Eng.exe (PID: 8052)

    • There is functionality for taking screenshot (YARA)

      • k-pacs.exe (PID: 7996)
      • kpserver.exe (PID: 5452)
      • Install-Eng.exe (PID: 8052)

  • INFO

    • Checks supported languages

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)
      • k-pacs.exe (PID: 7996)

    • Reads the computer name

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • Checks proxy server information

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • The sample compiled with german language support

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • The sample compiled with english language support

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • Create files in a temporary directory

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • Process checks computer location settings

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • k-pacs.exe (PID: 7996)

    • Compiled with Borland Delphi (YARA)

      • Install-Eng.exe (PID: 8052)
      • slui.exe (PID: 2088)
      • k-pacs.exe (PID: 7996)
      • kpserver.exe (PID: 5452)
      • conhost.exe (PID: 6640)

    • Creates files or folders in the user directory

      • Install-Eng.exe (PID: 8052)

    • Manual execution by a user

      • k-pacs.exe (PID: 7996)

    • Reads the software policy settings

      • slui.exe (PID: 2088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | WinRAR Self Extracting archive (94.3)
.scr | Windows screen saver (2.3)
.dll | Win32 Dynamic Link Library (generic) (1.1)
.exe | Win32 Executable (generic) (0.8)
.exe | Win32 Executable Watcom C++ (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2005:06:26 09:05:32+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5
CodeSize: 77824
InitializedDataSize: 22016
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start k-pacs installer v1.6.0 english.exe install-eng.exe slui.exe cmd.exe no specs conhost.exe no specs k-pacs.exe no specs kpserver.exe no specs conhost.exe no specs k-pacs installer v1.6.0 english.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2088C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5452"C:\KPacs\K-PACS-Server\KPServer.exe" +x= -dw -od "C:\KPacs\Imagebox" -aet KPServer 104C:\KPacs\K-Pacs-Server\kpserver.exe—k-pacs.exe
User:
admin
Company:
IMAGE Information Systems Ltd.
Integrity Level:
MEDIUM
Description:
StoreSCP Application
Version:
2, 5, 0, 1
Modules
Images
c:\kpacs\k-pacs-server\kpserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\wsock32.dll
6640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—kpserver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7344"C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe" C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\k-pacs installer v1.6.0 english.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7428"C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe" C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\k-pacs installer v1.6.0 english.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7752C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\uisF6AC.batC:\Windows\SysWOW64\cmd.exe—Install-Eng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7996"C:\KPacs\k-pacs.exe" C:\KPacs\k-pacs.exe—explorer.exe
User:
admin
Company:
IMAGE Information Systems Ltd.
Integrity Level:
MEDIUM
Description:
Free DICOM Workstation
Version:
1.6.0.3
Modules
Images
c:\kpacs\k-pacs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8052"C:\Users\admin\AppData\Local\Temp\Install-Eng.exe" C:\Users\admin\AppData\Local\Temp\Install-Eng.exe
K-Pacs Installer V1.6.0 English.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\install-eng.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
2 876
Read events
2 852
Write events
22
Delete events
2

Modification events

(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp
Operation:writeName:checkstate
Value:
0\
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\compress
Operation:writeName:comp
Value:
1
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\compress
Operation:writeName:jpeg
Value:
ja
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\crypt
Operation:writeName:anonym
Value:
nein
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\crypt
Operation:writeName:crypt
Value:
nein
Executable files
40
Suspicious files
1
Text files
20
Unknown types
2

Dropped files

PID
Process
Filename
Type
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\findscu.exeexecutable
MD5:A0BA3355014DF8E21FF69BFAAB175328
SHA256:031310F25949A8D90159AB5F050FFD0CADF6EFC65F892FAAB27586EE9819E263
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\German.initext
MD5:F3003E90E4F2D56C1ED1897AC355A232
SHA256:638A0280F490BA3D965F7B494219A337A5469F5DBD3E80B5FE1E06DAA65F3564
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\Install-Eng.exeexecutable
MD5:41CCA10FD569BE8E50653D442C651197
SHA256:2D6244198297BAE1FA90BE002C15D5DFB5BF0E2C340A5A541042EC85F44EB412
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\kpserver-nt-service.exeexecutable
MD5:16C98880D2B2C445E8059F58E60A25C3
SHA256:94DCB2353EF000AABDECA125F6AA6F0FE581CDD86F153A4E9104443E40EE5D2E
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\English.initext
MD5:5B690614D497DE2FB9B6F9BC67011B9B
SHA256:B7CF03CBACDBC635D7F7B6F459C6CD1F4AF0C27C235FBA59D6301D8F65C70C1F
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\movescu.exeexecutable
MD5:4E9493851869B0CFEEC407845D38DE57
SHA256:DE3274B134D4316BAB677B1BE0190E02F5871C713FCA88E122470E4D93E3C585
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\adminGerman.initext
MD5:BC9CAA42BE4F8BFD015BCBFEA26ECF32
SHA256:CE322F4460E66271D52D795FAF08BD9601C095B05EA697988351FCFB147E33B7
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\dcmmkdir.exeexecutable
MD5:B62A1F7BAD436340ED0D21E2A550BE14
SHA256:78CA4A07D4BFB97D66BE0CD0575C61EFF3E5E661137707215EF78FBC7D865045
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\KPUninstaller.exeexecutable
MD5:5579A3764C2A20064C2BADB5E023281D
SHA256:B300DB4EC42A99A4F200D0CE6C6E622966D16A6784A830EFEC0F05CAC34978DF
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\K-PACS EULA Evaluation.txttext
MD5:6832A8535BA4DDC19C867360A56EDFF7
SHA256:496972FAB9698FA9EC9B7DEE8027F80570863648D13DAEA3EBD65B91BAFCB840
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7596
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4944
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4944
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.16.164.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.40:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
2.16.164.40:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.40:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.40
  • 2.16.164.24
  • 2.16.164.72
  • 2.16.164.51
  • 2.16.164.32
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 20.198.162.78
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.4
  • 20.190.160.17
  • 20.190.160.22
  • 20.190.160.67
  • 20.190.160.131
  • 40.126.32.68
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
K-Pacs Installer V1.6.0 English.exe