File name:

T6UV Series EN CPS setup.exe

Full analysis: https://app.any.run/tasks/923d314e-d9ac-4b0e-9cb2-88a164d23c32
Verdict: Malicious activity
Analysis date: March 12, 2024, 10:03:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6877468AE3FD6F737A19753104D1801B

SHA1:

E558129916FE775E81F6ADBF2DAA6EFD0B877049

SHA256:

5EC618E8685CDC96BE90FBF3551EE402D7A89796C37F16819405B7F835B65905

SSDEEP:

98304:9zqGPqjIJfmXHH5fXpAz2ovQ1Bw9gfIGBvziDCED0mJVKJPjMrFPQ0TkZ96Clomk:hjO7Jry

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.tmp (PID: 1652)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.tmp (PID: 1652)

    • Reads the Windows owner or organization settings

      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.tmp (PID: 1652)

    • Non-standard symbols in registry

      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.tmp (PID: 1652)

    • Reads security settings of Internet Explorer

      • T6UV Series EN CPS.exe (PID: 2304)
      • WinRAR.exe (PID: 240)
      • Skype-Setup.tmp (PID: 1652)

    • Reads the Internet Settings

      • T6UV Series EN CPS.exe (PID: 2304)
      • Skype.exe (PID: 2248)
      • Skype-Setup.tmp (PID: 1652)

    • Application launched itself

      • WinRAR.exe (PID: 240)
      • Skype.exe (PID: 2248)

    • Searches for installed software

      • Skype-Setup.tmp (PID: 1652)

    • Uses TASKKILL.EXE to kill process

      • Skype-Setup.tmp (PID: 1652)

    • Process drops legitimate windows executable

      • Skype-Setup.tmp (PID: 1652)

    • The process drops C-runtime libraries

      • Skype-Setup.tmp (PID: 1652)

  • INFO

    • Create files in a temporary directory

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.tmp (PID: 1652)

    • Checks supported languages

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.tmp (PID: 3864)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • T6UV Series EN CPS.exe (PID: 2304)
      • Skype.exe (PID: 2248)
      • Skype.exe (PID: 3800)
      • Skype.exe (PID: 2128)
      • Skype.exe (PID: 1608)
      • Skype-Setup.tmp (PID: 1216)
      • Skype-Setup.exe (PID: 924)
      • Skype.exe (PID: 124)
      • Skype-Setup.tmp (PID: 1652)
      • Skype.exe (PID: 4080)
      • Skype-Setup.exe (PID: 3112)

    • Reads the computer name

      • T6UV Series EN CPS setup.tmp (PID: 3864)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • T6UV Series EN CPS.exe (PID: 2304)
      • Skype.exe (PID: 2248)
      • Skype.exe (PID: 2128)
      • Skype.exe (PID: 1608)
      • Skype-Setup.tmp (PID: 1216)
      • Skype.exe (PID: 4080)
      • Skype.exe (PID: 124)
      • Skype-Setup.tmp (PID: 1652)

    • Creates files in the program directory

      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • WinRAR.exe (PID: 980)
      • Skype-Setup.tmp (PID: 1652)

    • Creates a software uninstall entry

      • T6UV Series EN CPS setup.tmp (PID: 2964)

    • Reads the machine GUID from the registry

      • T6UV Series EN CPS.exe (PID: 2304)

    • Manual execution by a user

      • WinRAR.exe (PID: 240)
      • explorer.exe (PID: 4008)
      • Skype.exe (PID: 2248)
      • msedge.exe (PID: 3000)
      • chrome.exe (PID: 2404)

    • Reads Environment values

      • Skype.exe (PID: 2248)

    • Reads CPU info

      • Skype.exe (PID: 2248)

    • Creates files or folders in the user directory

      • Skype.exe (PID: 2248)

    • Reads product name

      • Skype.exe (PID: 2248)

    • Application launched itself

      • msedge.exe (PID: 3000)
      • chrome.exe (PID: 2404)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 2548)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: My Company, Inc.
FileDescription: T6UV Series EN CPS Setup
FileVersion:
LegalCopyright:
ProductName: T6UV Series EN CPS
ProductVersion: 1.1.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
96
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start t6uv series en cps setup.exe t6uv series en cps setup.tmp no specs t6uv series en cps setup.exe t6uv series en cps setup.tmp t6uv series en cps.exe no specs explorer.exe no specs winrar.exe no specs winrar.exe skype.exe skype.exe skype.exe no specs skype.exe no specs skype-setup.exe skype.exe no specs skype-setup.tmp no specs skype.exe no specs skype-setup.exe skype-setup.tmp taskkill.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 --field-trial-handle=1332,i,13043953484380830497,15372047912263629630,131072 --enable-features=WinUseBrowserSpellChecker,WinUseHybridSpellChecker,WinrtGeolocationImplementation --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
LOW
Description:
Skype
Exit code:
0
Version:
8.110.0.215
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
240"C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -- . "C:\Program Files\T6UV Series EN CPS\DevComponents.DotNetBar2.dll" "C:\Program Files\T6UV Series EN CPS\Import Picture tools.exe" "C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe" "C:\Program Files\T6UV Series EN CPS\unins000.dat" "C:\Program Files\T6UV Series EN CPS\unins000.exe"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6040 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6352 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2460 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3676 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5164 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
712"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5868 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5580 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6152 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
19 339
Read events
19 103
Write events
217
Delete events
19

Modification events

(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
940B000074D6268E6474DA01
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
0DC8E0FB3B7282CE8E6761452447108CB47BB993187159134BC6D09F7F7A7CC3
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
AAD03D031DAA175313CA1BB394C7365700DD322C6AF3503828F30EA4719B1C19
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (a)
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\T6UV Series EN CPS
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\T6UV Series EN CPS\
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
T6UV Series EN CPS
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
109
Suspicious files
166
Text files
163
Unknown types
114

Dropped files

PID
Process
Filename
Type
1776T6UV Series EN CPS setup.exeC:\Users\admin\AppData\Local\Temp\is-LSM7V.tmp\T6UV Series EN CPS setup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\unins000.exeexecutable
MD5:CD983F0B33227D008BE4124DE8B92FD2
SHA256:7904632680724542DF22D6901986DDBE2BA7D3C999E67F3ED7B496CE8575BFDC
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-3O0PJ.tmpexecutable
MD5:CD983F0B33227D008BE4124DE8B92FD2
SHA256:7904632680724542DF22D6901986DDBE2BA7D3C999E67F3ED7B496CE8575BFDC
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-3UUNH.tmpexecutable
MD5:97CBFEC13666D2C17A8BA3112712C844
SHA256:D1B0B74AAA103C795F6A0C685BB90E3FB6131F9F137F60CCE7C533D5A3015157
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\Import Picture tools.exeexecutable
MD5:802791FDBABD58D3B59FBE4A24C91C42
SHA256:88236DB4452230C512526AB1B7D5C2DE438295CD0A6B6BAAA2AE0AFB0C72ED59
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-67U7S.tmpexecutable
MD5:58D4CA6492C206804922F894BF44B0B1
SHA256:5FB0880F45602A56A55DFBA6E9A20A7972AC9F75E4286FD8F406372E0343AE1D
3668T6UV Series EN CPS setup.exeC:\Users\admin\AppData\Local\Temp\is-RJ1HB.tmp\T6UV Series EN CPS setup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exeexecutable
MD5:58D4CA6492C206804922F894BF44B0B1
SHA256:5FB0880F45602A56A55DFBA6E9A20A7972AC9F75E4286FD8F406372E0343AE1D
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-87BF2.tmpexecutable
MD5:802791FDBABD58D3B59FBE4A24C91C42
SHA256:88236DB4452230C512526AB1B7D5C2DE438295CD0A6B6BAAA2AE0AFB0C72ED59
924Skype-Setup.exeC:\Users\admin\AppData\Local\Temp\is-62TO9.tmp\Skype-Setup.tmpexecutable
MD5:55364BFEA54A03CCBA0F0400DF3D629F
SHA256:94B0E7DCDE2CBE4543EB28111FC5567EA622437F5A58A5E716BB7CFE0BF8DFAE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
296
DNS requests
386
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
45.3 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
170 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
118 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
975 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
177 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
729 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
1.33 Mb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
1.45 Mb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
1.15 Mb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
436 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2248
Skype.exe
52.113.194.133:443
get.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2248
Skype.exe
13.107.42.16:443
a.config.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2248
Skype.exe
23.200.212.163:443
download.skype.com
AKAMAI-AS
FR
unknown
3000
msedge.exe
239.255.255.250:1900
—
—
—
unknown
4012
msedge.exe
204.79.197.203:443
ntp.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4012
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
get.skype.com
  • 52.113.194.133
whitelisted
a.config.skype.com
  • 13.107.42.16
whitelisted
download.skype.com
  • 23.200.212.163
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.bing.com
  • 23.196.15.82
  • 23.196.15.33
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted
assets.msn.com
  • 23.196.15.41
  • 23.196.15.57
  • 23.196.15.59
whitelisted
clientservices.googleapis.com
  • 216.58.206.67
whitelisted

Threats

PID
Process
Class
Message
3224
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3224
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3224
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
Process
Message
Skype.exe
[0312/100417.437:ERROR:filesystem_win.cc(130)] GetFileAttributes C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\attachments\3a0ee62b-79ac-4cc3-bbd5-f65252e7a91f: The system cannot find the file specified. (0x2)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
T6UV Series EN CPS setup.exe