File name:

5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe

Full analysis: https://app.any.run/tasks/e9635127-3a83-45ac-973e-e01cf6a1d9de
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 03, 2025, 16:42:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

D2AD2978B8B1ABC4CEF93117273A082B

SHA1:

6D813AFFA791957B405B19456621262F4535C390

SHA256:

5E5A4F1BB6DE2EBAF064B13FE7056B88E2D400B4402DAA2C3DD4B611294DDD2E

SSDEEP:

196608:sic3YDQu8D/eVVnchS6n6tmpERmA1yTdDMyJJi3axkm:Tco0D/eVihSIpET6GyJ2m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 6152)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 2632)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)
      • TiWorker.exe (PID: 5084)

    • Reads security settings of Internet Explorer

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)

    • Reads the Windows owner or organization settings

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)
      • msiexec.exe (PID: 1180)

    • Drops 7-zip archiver for unpacking

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • The process drops C-runtime libraries

      • TiWorker.exe (PID: 5084)
      • msiexec.exe (PID: 1180)

    • The process verifies whether the antivirus software is installed

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

  • INFO

    • Checks supported languages

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 6152)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 2632)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)
      • msiexec.exe (PID: 1180)
      • msiexec.exe (PID: 3608)

    • Create files in a temporary directory

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 6152)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 2632)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • Reads Environment values

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)

    • Process checks computer location settings

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)

    • Reads the computer name

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 2632)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)
      • msiexec.exe (PID: 1180)
      • msiexec.exe (PID: 3608)

    • The sample compiled with english language support

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)
      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1180)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 1180)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1180)

    • Reads the software policy settings

      • msiexec.exe (PID: 1180)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)
      • slui.exe (PID: 2628)

    • The sample compiled with chinese language support

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • The sample compiled with german language support

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • The sample compiled with spanish language support

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • The sample compiled with Italian language support

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • The sample compiled with korean language support

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • Detects InnoSetup installer (YARA)

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 6152)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 2632)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • Compiled with Borland Delphi (YARA)

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 6152)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 2972)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe (PID: 2632)
      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • The sample compiled with japanese language support

      • TiWorker.exe (PID: 5084)
      • msiexec.exe (PID: 1180)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1180)

    • The sample compiled with french language support

      • msiexec.exe (PID: 1180)
      • TiWorker.exe (PID: 5084)

    • Reads CPU info

      • 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp (PID: 5780)

    • Checks proxy server information

      • slui.exe (PID: 2628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:08 15:36:35+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 684032
InitializedDataSize: 476160
UninitializedDataSize: -
EntryPoint: 0xa7f98
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: GTA V Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: GTA V
ProductVersion: 0.0.0.1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
10
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp no specs 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe 5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp msiexec.exe no specs msiexec.exe msiexec.exe no specs tiworker.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1180C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2628C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2632"C:\Users\admin\Desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe" /SPAWNWND=$A02FC /NOTIFYWND=$C02F6 C:\Users\admin\Desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe
5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
GTA V Setup
Version:
Modules
Images
c:\users\admin\desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2972"C:\Users\admin\AppData\Local\Temp\is-U9HS6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp" /SL5="$C02F6,18179271,1161216,C:\Users\admin\Desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe" C:\Users\admin\AppData\Local\Temp\is-U9HS6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp—5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-u9hs6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3608C:\Windows\syswow64\MsiExec.exe -Embedding E20112A3F654A853E96C780D2D23FD3AC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3932"msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\vcredist.msi /qnC:\Windows\SysWOW64\msiexec.exe—5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5084C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Exit code:
0
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5780"C:\Users\admin\AppData\Local\Temp\is-C38N6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp" /SL5="$70252,18179271,1161216,C:\Users\admin\Desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe" /SPAWNWND=$A02FC /NOTIFYWND=$C02F6 C:\Users\admin\AppData\Local\Temp\is-C38N6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp
5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-c38n6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
6152"C:\Users\admin\Desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe" C:\Users\admin\Desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
GTA V Setup
Version:
Modules
Images
c:\users\admin\desktop\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
Total events
14 104
Read events
13 233
Write events
799
Delete events
72

Modification events

(PID) Process:(1180) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
9C0400002203CEC8F11CDC01
(PID) Process:(1180) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
FE5BB6722D3A5467F43869D59AFD1B84B2C0EB00B0FB47497E66F142B7B8FF65
(PID) Process:(1180) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\18f51b.rbs
Value:
31202545
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\18f51b.rbsLow
Value:
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F942F94A19C0F79468FD2B85E5E8677B
Operation:writeName:c1c4f01781cc94c4c8fb1542c0981a2a
Value:
02:\SOFTWARE\Microsoft\DevDiv\VC\Servicing\8.0\RED\1033\Install
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77EB05CE46035D115AA4000972A8B18B
Operation:writeName:c1c4f01781cc94c4c8fb1542c0981a2a
Value:
02:\SOFTWARE\Microsoft\DevDiv\VC\Servicing\8.0\SP
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0EF18C3B9B1A1EE8
Operation:writeName:c1c4f01781cc94c4c8fb1542c0981a2a
Value:
(PID) Process:(1180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8
Operation:writeName:c1c4f01781cc94c4c8fb1542c0981a2a
Value:
>ATL80.dll\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86"
Executable files
82
Suspicious files
88
Text files
391
Unknown types
0

Dropped files

PID
Process
Filename
Type
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\libs.7z —
MD5:—
SHA256:—
61525e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exeC:\Users\admin\AppData\Local\Temp\is-U9HS6.tmp\5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpexecutable
MD5:1686B594C94F585111D6392B6BA9A573
SHA256:4C080954182F3152C00BB4B116067F3CA1B3D7762FF08273E0BE54EDE3087658
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\CFLite.resources\CFUnicodeData-B.mappingbinary
MD5:9B5B382CBD127EE52B2CABF51112624E
SHA256:B7EC3164389BFB5E6CDCC60F77533FD842FBA219263EA30621DF18CE1C6DE09F
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\Dictionaries\en_US.afftext
MD5:D329845E5D86AFEBE0DB82B3422C70C2
SHA256:56E2090475E1CE11A1885CE8ECE4D4B1F1E863F69A7233CC00BAF56CDAAA9096
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\view\main.jsbinary
MD5:35F8F60C9E93CE7C7BA34EE82F4B8848
SHA256:02B3D253C4AAB963D1155133F2D4AF351B213F94106760D7534FE0E2271A7390
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\CFLite.resources\CFCharacterSetBitmaps.bitmapbinary
MD5:C296628E32131F103F370A1315B8B6AC
SHA256:5C66E729F7817455193076D386F72C498874A7307ECCDF0DA4D93E13ABBAC2A8
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\CFLite.resources\CFUnicodeData-L.mappingbinary
MD5:21D1E35F9FA5CB37772AE4A25687F1B4
SHA256:9C7EEF81142CF859E45ED41BE1133904CAD5A014BB0D44D7F0F0A10AA9219537
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\CFLite.resources\Info.plistxml
MD5:58FB86ED6E4E45D86AF994BABBA3460B
SHA256:D83EC6C2C3CEE012D8F11DC5B08998AA4C6E55C467567DC9375C4F4DEC2DEF78
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\vcredist.msiexecutable
MD5:B20BBEB818222B657DF49A9CFE4FED79
SHA256:91BDD063F6C53126737791C9ECCF0B2F4CF44927831527245BC89A0BE06C0CB4
57805e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.tmpC:\Users\admin\AppData\Local\Temp\is-UK3GT.tmp\Dictionaries\README_en_US.txttext
MD5:9BF37A3C2CC38A159CCAFC22C7341DE3
SHA256:09FC0493763C5E924856FEFBD7F84BC2314338BD4D1455B25A13CF75DE8303D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
50
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.16.164.123:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
—
—
GET
200
2.16.164.123:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
—
—
POST
200
20.190.160.130:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
unknown
—
—
POST
400
20.190.160.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
unknown
1180
msiexec.exe
GET
200
2.16.164.123:80
http://crl.microsoft.com/pki/crl/products/CSPCA.crl
NL
binary
506 b
whitelisted
—
—
POST
200
20.190.160.22:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
unknown
—
—
POST
200
40.126.32.72:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
16.7 Kb
unknown
—
—
POST
200
20.190.160.132:443
https://login.live.com/RST2.srf
US
xml
10.3 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.16.164.123:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.123:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3644
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1180
msiexec.exe
2.16.164.123:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.164.123
  • 2.16.164.42
  • 2.16.164.83
  • 2.16.164.120
  • 2.16.164.107
  • 2.16.164.91
  • 2.16.164.112
  • 2.16.164.34
  • 2.16.164.105
  • 2.16.164.74
  • 2.16.164.35
  • 2.16.164.66
  • 2.16.164.104
  • 2.16.164.75
  • 2.16.164.98
  • 2.16.164.64
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.132
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.74
whitelisted
files-6.ru
  • 89.108.83.41
malicious
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
self.events.data.microsoft.com
  • 20.42.65.90
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5e5a4f1bb6de2ebaf064b13fe7056b88e2d400b4402daa2c3dd4b611294ddd2e.exe