File name:

Nonsense_Diamond-Installer.zip

Full analysis: https://app.any.run/tasks/1fddadd8-4002-4aed-b215-8550f80a90c0
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: June 21, 2025, 17:09:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
adware
discord
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B4520AE4D12B4145BFC894CC76C63E71

SHA1:

45CE27630AA5A80E245C91B2E372A220FE4FEEDB

SHA256:

5A1C58AFDEC4B23C1B1F985D00C37B2858A417C38C3F41B0C78D4E51CF7942F0

SSDEEP:

98304:N1uFZkdvbi0Z7sOsDTPxj3wkeY5ahGLNmkhI29+7txMtsS6MZ+Ggq6u1XY6T/BGR:uH6M5AXTf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6640)
    • ADWARE has been detected (SURICATA)

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6640)
      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
      • ShellExperienceHost.exe (PID: 2964)
    • Searches for installed software

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
    • Access to an unwanted program domain was detected

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
    • There is functionality for taking screenshot (YARA)

      • Nonsense Diamond-Installer.exe (PID: 5952)
  • INFO

    • Checks supported languages

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
      • ShellExperienceHost.exe (PID: 2964)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6640)
    • Reads the computer name

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
      • ShellExperienceHost.exe (PID: 2964)
    • Checks proxy server information

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
    • Reads the software policy settings

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
    • Reads the machine GUID from the registry

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
    • Creates files or folders in the user directory

      • Nonsense Diamond-Installer.exe (PID: 4192)
    • Create files in a temporary directory

      • Nonsense Diamond-Installer.exe (PID: 4192)
      • Nonsense Diamond-Installer.exe (PID: 5952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:07:12 19:11:54
ZipCRC: 0x8d91c732
ZipCompressedSize: 2451854
ZipUncompressedSize: 5320192
ZipFileName: Nonsense Diamond-Installer.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe nonsense diamond-installer.exe no specs #ADWARE nonsense diamond-installer.exe nonsense diamond-installer.exe no specs #ADWARE nonsense diamond-installer.exe rundll32.exe no specs shellexperiencehost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
3836C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3936"C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.7984\Nonsense Diamond-Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.7984\Nonsense Diamond-Installer.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6640.7984\nonsense diamond-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4192"C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.7984\Nonsense Diamond-Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.7984\Nonsense Diamond-Installer.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6640.7984\nonsense diamond-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5284C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5952"C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.9993\Nonsense Diamond-Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.9993\Nonsense Diamond-Installer.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6640.9993\nonsense diamond-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6640"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Nonsense_Diamond-Installer.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6936"C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.9993\Nonsense Diamond-Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6640.9993\Nonsense Diamond-Installer.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6640.9993\nonsense diamond-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
6 233
Read events
6 144
Write events
28
Delete events
61

Modification events

(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Nonsense_Diamond-Installer.zip
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6640) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4192) Nonsense Diamond-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en-us
Value:
(PID) Process:(4192) Nonsense Diamond-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en
Value:
Executable files
5
Suspicious files
5
Text files
8
Unknown types
1

Dropped files

PID
Process
Filename
Type
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dictext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acltext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:35D786BB583978E7C0A5A8EB07DF271F
SHA256:40AE3866FDCA26337D5EFF7BF23238F97EC06429CFCD219ED8A793CDFC90FD32
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exctext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
6640WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_6640.9721compressed
MD5:93029833CE40542549741B9C7407DB2B
SHA256:35252D78E9DB6CBF619E926606DD4708B5C9694E349349A4C553B65CE1C80403
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
6640WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6640.9993\Nonsense Diamond-Installer.exeexecutable
MD5:9400D81060546AFEE584EC7C9DD60C94
SHA256:060CD16D54984E8332DC1347FC95EC40FBEC601DE56B7E60DA3D911684FB3613
4192Nonsense Diamond-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:4FC0CCEDE72E092F9DBBE517B8B8218A
SHA256:D9A9CAE574A8D0110C27E8731DA7D689FA7AA8281C4BADD344BAFDBEA61805EA
6640WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6640.9993\Nonsense Diamond.exetext
MD5:A1CA4BEBCD03FAFBE2B06A46A694E29A
SHA256:C3FA59901D56CE8A95A303B22FD119CB94ABF4F43C4F6D60A81FD78B7D00FA65
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
30
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4192
Nonsense Diamond-Installer.exe
POST
404
35.190.60.70:80
http://dlsft.com/callback/geo/geo.php
unknown
malicious
4192
Nonsense Diamond-Installer.exe
GET
404
35.190.60.70:80
http://dlsft.com/callback/offers.php
unknown
malicious
4192
Nonsense Diamond-Installer.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=Diamond&action=started
unknown
whitelisted
4192
Nonsense Diamond-Installer.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
4192
Nonsense Diamond-Installer.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/r4.crl
unknown
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4192
Nonsense Diamond-Installer.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=Diamond&action=completed
unknown
whitelisted
5952
Nonsense Diamond-Installer.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=Diamond&action=started
unknown
whitelisted
5952
Nonsense Diamond-Installer.exe
GET
404
35.190.60.70:80
http://dlsft.com/callback/offers.php
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4816
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
4192
Nonsense Diamond-Installer.exe
162.159.133.232:443
media.discordapp.net
CLOUDFLARENET
whitelisted
4192
Nonsense Diamond-Installer.exe
35.190.60.70:80
dlsft.com
GOOGLE
US
whitelisted
4192
Nonsense Diamond-Installer.exe
216.58.206.35:80
c.pki.goog
GOOGLE
US
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
media.discordapp.net
  • 162.159.133.232
  • 162.159.134.232
  • 162.159.129.232
  • 162.159.130.232
  • 162.159.128.232
whitelisted
dlsft.com
  • 35.190.60.70
unknown
c.pki.goog
  • 216.58.206.35
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
cdn.discordapp.com
  • 162.159.135.233
  • 162.159.134.233
  • 162.159.130.233
  • 162.159.129.233
  • 162.159.133.233
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
4192
Nonsense Diamond-Installer.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Win32/LinkPadBundle (geolocation request)
2200
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
4192
Nonsense Diamond-Installer.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
5952
Nonsense Diamond-Installer.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Win32/LinkPadBundle (geolocation request)
5952
Nonsense Diamond-Installer.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info