File name:

K-Pacs Installer V1.6.0 English.exe

Full analysis: https://app.any.run/tasks/6c4a9f39-1720-404f-8d3a-21fb82c653bf
Verdict: Malicious activity
Analysis date: March 13, 2025, 14:11:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections
MD5:

4ACD7DF0A52701F962C5B799504DEDD4

SHA1:

B3BDF037F657F3D8BD8C26735707D4C9EEA7021A

SHA256:

5342831C0B2B50D93F558B167B5962E3E422FC43EE93E8A03DE0B2BF2CD324D9

SSDEEP:

98304:pjXPcdpTu9NqynZUz3GGysmLd/MusPLUHhYvo6kaM9ibRHcjNCJknx3VhhxTIlwv:nlmug7sRG/SJF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Reads security settings of Internet Explorer

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Reads Internet Explorer settings

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Executable content was dropped or overwritten

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • There is functionality for taking screenshot (YARA)

      • Install-Eng.exe (PID: 8052)
      • kpserver.exe (PID: 5452)
      • k-pacs.exe (PID: 7996)

    • Starts CMD.EXE for commands execution

      • Install-Eng.exe (PID: 8052)

    • Executing commands from a ".bat" file

      • Install-Eng.exe (PID: 8052)

  • INFO

    • Checks supported languages

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)
      • k-pacs.exe (PID: 7996)

    • Checks proxy server information

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)

    • Reads the computer name

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • The sample compiled with english language support

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • The sample compiled with german language support

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • Process checks computer location settings

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • k-pacs.exe (PID: 7996)

    • Compiled with Borland Delphi (YARA)

      • slui.exe (PID: 2088)
      • Install-Eng.exe (PID: 8052)
      • k-pacs.exe (PID: 7996)
      • kpserver.exe (PID: 5452)
      • conhost.exe (PID: 6640)

    • Create files in a temporary directory

      • K-Pacs Installer V1.6.0 English.exe (PID: 7428)
      • Install-Eng.exe (PID: 8052)

    • Reads the software policy settings

      • slui.exe (PID: 2088)

    • Creates files or folders in the user directory

      • Install-Eng.exe (PID: 8052)

    • Manual execution by a user

      • k-pacs.exe (PID: 7996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | WinRAR Self Extracting archive (94.3)
.scr | Windows screen saver (2.3)
.dll | Win32 Dynamic Link Library (generic) (1.1)
.exe | Win32 Executable (generic) (0.8)
.exe | Win32 Executable Watcom C++ (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2005:06:26 09:05:32+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5
CodeSize: 77824
InitializedDataSize: 22016
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start k-pacs installer v1.6.0 english.exe install-eng.exe slui.exe cmd.exe no specs conhost.exe no specs k-pacs.exe no specs kpserver.exe no specs conhost.exe no specs k-pacs installer v1.6.0 english.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2088C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5452"C:\KPacs\K-PACS-Server\KPServer.exe" +x= -dw -od "C:\KPacs\Imagebox" -aet KPServer 104C:\KPacs\K-Pacs-Server\kpserver.exe—k-pacs.exe
User:
admin
Company:
IMAGE Information Systems Ltd.
Integrity Level:
MEDIUM
Description:
StoreSCP Application
Version:
2, 5, 0, 1
Modules
Images
c:\kpacs\k-pacs-server\kpserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\wsock32.dll
6640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—kpserver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7344"C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe" C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\k-pacs installer v1.6.0 english.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7428"C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe" C:\Users\admin\AppData\Local\Temp\K-Pacs Installer V1.6.0 English.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\k-pacs installer v1.6.0 english.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7752C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\uisF6AC.batC:\Windows\SysWOW64\cmd.exe—Install-Eng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7996"C:\KPacs\k-pacs.exe" C:\KPacs\k-pacs.exe—explorer.exe
User:
admin
Company:
IMAGE Information Systems Ltd.
Integrity Level:
MEDIUM
Description:
Free DICOM Workstation
Version:
1.6.0.3
Modules
Images
c:\kpacs\k-pacs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8052"C:\Users\admin\AppData\Local\Temp\Install-Eng.exe" C:\Users\admin\AppData\Local\Temp\Install-Eng.exe
K-Pacs Installer V1.6.0 English.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\install-eng.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
2 876
Read events
2 852
Write events
22
Delete events
2

Modification events

(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(7428) K-Pacs Installer V1.6.0 English.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp
Operation:writeName:checkstate
Value:
0\
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\compress
Operation:writeName:comp
Value:
1
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\compress
Operation:writeName:jpeg
Value:
ja
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\crypt
Operation:writeName:anonym
Value:
nein
(PID) Process:(8052) Install-Eng.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\dicom-tools\qrscp\crypt
Operation:writeName:crypt
Value:
nein
Executable files
40
Suspicious files
1
Text files
20
Unknown types
2

Dropped files

PID
Process
Filename
Type
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\WindowsGer.txttext
MD5:C25576F273217A39C2A2285AB4E748B6
SHA256:593E11A375B4FFB8D3FA30F0BC996CD8BA9C3D3F10454E6D2F131EB0E3E2BDC0
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\English.initext
MD5:5B690614D497DE2FB9B6F9BC67011B9B
SHA256:B7CF03CBACDBC635D7F7B6F459C6CD1F4AF0C27C235FBA59D6301D8F65C70C1F
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\Install-Eng.exeexecutable
MD5:41CCA10FD569BE8E50653D442C651197
SHA256:2D6244198297BAE1FA90BE002C15D5DFB5BF0E2C340A5A541042EC85F44EB412
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\findscu.exeexecutable
MD5:A0BA3355014DF8E21FF69BFAAB175328
SHA256:031310F25949A8D90159AB5F050FFD0CADF6EFC65F892FAAB27586EE9819E263
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\KPUninstaller.exeexecutable
MD5:5579A3764C2A20064C2BADB5E023281D
SHA256:B300DB4EC42A99A4F200D0CE6C6E622966D16A6784A830EFEC0F05CAC34978DF
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\WindowsEng.txttext
MD5:E26CB06775234B104EEF2CB5D1C139D5
SHA256:CE265761E3AC073EAE1561FF6F23B52F9E6EFF80D921257E4328C64E8390FA2B
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\kpserver-nt-service.exeexecutable
MD5:16C98880D2B2C445E8059F58E60A25C3
SHA256:94DCB2353EF000AABDECA125F6AA6F0FE581CDD86F153A4E9104443E40EE5D2E
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\dcmdjpeg.exeexecutable
MD5:A4BD05E7198EB10BF8512457AA705D94
SHA256:84CBE872834D7FDA4D7115652FFAE475003A85E75D782BB9D669EC54006760AA
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\ReadMe.txttext
MD5:E9E60EB891714C29297BD324A2A0D73A
SHA256:C67221DADA4EB5E96E31544D15D4BE1986C207E24B6CE91BAA11D7E49680792D
7428K-Pacs Installer V1.6.0 English.exeC:\Users\admin\AppData\Local\Temp\adminEnglish.initext
MD5:7730CA15DCCA99931A62D9B7C6F070B4
SHA256:48997971DCB2E3DA0EB759E41817981754333A6D240F8025024FC5D9F3A56C92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.16.164.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4944
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4944
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7596
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.40:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
2.16.164.40:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.40:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.40
  • 2.16.164.24
  • 2.16.164.72
  • 2.16.164.51
  • 2.16.164.32
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 20.198.162.78
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.4
  • 20.190.160.17
  • 20.190.160.22
  • 20.190.160.67
  • 20.190.160.131
  • 40.126.32.68
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
K-Pacs Installer V1.6.0 English.exe