File name:

T6UV Series EN CPS setup.exe

Full analysis: https://app.any.run/tasks/923d314e-d9ac-4b0e-9cb2-88a164d23c32
Verdict: Malicious activity
Analysis date: March 12, 2024, 10:03:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6877468AE3FD6F737A19753104D1801B

SHA1:

E558129916FE775E81F6ADBF2DAA6EFD0B877049

SHA256:

5EC618E8685CDC96BE90FBF3551EE402D7A89796C37F16819405B7F835B65905

SSDEEP:

98304:9zqGPqjIJfmXHH5fXpAz2ovQ1Bw9gfIGBvziDCED0mJVKJPjMrFPQ0TkZ96Clomk:hjO7Jry

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.tmp (PID: 1652)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.tmp (PID: 1652)

    • Reads the Windows owner or organization settings

      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.tmp (PID: 1652)

    • Non-standard symbols in registry

      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype-Setup.tmp (PID: 1652)

    • Reads security settings of Internet Explorer

      • T6UV Series EN CPS.exe (PID: 2304)
      • WinRAR.exe (PID: 240)
      • Skype-Setup.tmp (PID: 1652)

    • Application launched itself

      • WinRAR.exe (PID: 240)
      • Skype.exe (PID: 2248)

    • Reads the Internet Settings

      • T6UV Series EN CPS.exe (PID: 2304)
      • Skype.exe (PID: 2248)
      • Skype-Setup.tmp (PID: 1652)

    • Uses TASKKILL.EXE to kill process

      • Skype-Setup.tmp (PID: 1652)

    • Searches for installed software

      • Skype-Setup.tmp (PID: 1652)

    • Process drops legitimate windows executable

      • Skype-Setup.tmp (PID: 1652)

    • The process drops C-runtime libraries

      • Skype-Setup.tmp (PID: 1652)

  • INFO

    • Checks supported languages

      • T6UV Series EN CPS setup.exe (PID: 3668)
      • T6UV Series EN CPS setup.exe (PID: 1776)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • T6UV Series EN CPS.exe (PID: 2304)
      • T6UV Series EN CPS setup.tmp (PID: 3864)
      • Skype.exe (PID: 2128)
      • Skype.exe (PID: 2248)
      • Skype.exe (PID: 3800)
      • Skype.exe (PID: 124)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.tmp (PID: 1216)
      • Skype.exe (PID: 1608)
      • Skype.exe (PID: 4080)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.tmp (PID: 1652)

    • Reads the computer name

      • T6UV Series EN CPS setup.tmp (PID: 3864)
      • T6UV Series EN CPS.exe (PID: 2304)
      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • Skype.exe (PID: 2128)
      • Skype.exe (PID: 1608)
      • Skype-Setup.tmp (PID: 1216)
      • Skype.exe (PID: 4080)
      • Skype.exe (PID: 124)
      • Skype-Setup.tmp (PID: 1652)
      • Skype.exe (PID: 2248)

    • Create files in a temporary directory

      • T6UV Series EN CPS setup.exe (PID: 1776)
      • T6UV Series EN CPS setup.exe (PID: 3668)
      • Skype-Setup.exe (PID: 3112)
      • Skype-Setup.exe (PID: 924)
      • Skype-Setup.tmp (PID: 1652)

    • Creates a software uninstall entry

      • T6UV Series EN CPS setup.tmp (PID: 2964)

    • Creates files in the program directory

      • T6UV Series EN CPS setup.tmp (PID: 2964)
      • WinRAR.exe (PID: 980)
      • Skype-Setup.tmp (PID: 1652)

    • Manual execution by a user

      • explorer.exe (PID: 4008)
      • WinRAR.exe (PID: 240)
      • Skype.exe (PID: 2248)
      • msedge.exe (PID: 3000)
      • chrome.exe (PID: 2404)

    • Reads Environment values

      • Skype.exe (PID: 2248)

    • Reads product name

      • Skype.exe (PID: 2248)

    • Creates files or folders in the user directory

      • Skype.exe (PID: 2248)

    • Reads CPU info

      • Skype.exe (PID: 2248)

    • Reads the machine GUID from the registry

      • T6UV Series EN CPS.exe (PID: 2304)

    • Application launched itself

      • msedge.exe (PID: 3000)
      • chrome.exe (PID: 2404)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2548)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: My Company, Inc.
FileDescription: T6UV Series EN CPS Setup
FileVersion:
LegalCopyright:
ProductName: T6UV Series EN CPS
ProductVersion: 1.1.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
96
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start t6uv series en cps setup.exe t6uv series en cps setup.tmp no specs t6uv series en cps setup.exe t6uv series en cps setup.tmp t6uv series en cps.exe no specs explorer.exe no specs winrar.exe no specs winrar.exe skype.exe skype.exe skype.exe no specs skype.exe no specs skype-setup.exe skype.exe no specs skype-setup.tmp no specs skype.exe no specs skype-setup.exe skype-setup.tmp taskkill.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 --field-trial-handle=1332,i,13043953484380830497,15372047912263629630,131072 --enable-features=WinUseBrowserSpellChecker,WinUseHybridSpellChecker,WinrtGeolocationImplementation --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
LOW
Description:
Skype
Exit code:
0
Version:
8.110.0.215
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
240"C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -- . "C:\Program Files\T6UV Series EN CPS\DevComponents.DotNetBar2.dll" "C:\Program Files\T6UV Series EN CPS\Import Picture tools.exe" "C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe" "C:\Program Files\T6UV Series EN CPS\unins000.dat" "C:\Program Files\T6UV Series EN CPS\unins000.exe"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6040 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6352 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2460 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3676 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5164 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
712"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5868 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5580 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6152 --field-trial-handle=1160,i,2562398909866583467,8070989386116759491,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
19 339
Read events
19 103
Write events
217
Delete events
19

Modification events

(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
940B000074D6268E6474DA01
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
0DC8E0FB3B7282CE8E6761452447108CB47BB993187159134BC6D09F7F7A7CC3
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
AAD03D031DAA175313CA1BB394C7365700DD322C6AF3503828F30EA4719B1C19
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (a)
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\T6UV Series EN CPS
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\T6UV Series EN CPS\
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
T6UV Series EN CPS
(PID) Process:(2964) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
109
Suspicious files
166
Text files
163
Unknown types
114

Dropped files

PID
Process
Filename
Type
980WinRAR.exeC:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.rarcompressed
MD5:67221B5F4C000FF49E15BB86D92D6411
SHA256:1148DB72F064F8A64E9234AC34CBEF19E989A59575536367FF8A6992339655A1
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exeexecutable
MD5:58D4CA6492C206804922F894BF44B0B1
SHA256:5FB0880F45602A56A55DFBA6E9A20A7972AC9F75E4286FD8F406372E0343AE1D
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\DevComponents.DotNetBar2.dllexecutable
MD5:97CBFEC13666D2C17A8BA3112712C844
SHA256:D1B0B74AAA103C795F6A0C685BB90E3FB6131F9F137F60CCE7C533D5A3015157
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-3O0PJ.tmpexecutable
MD5:CD983F0B33227D008BE4124DE8B92FD2
SHA256:7904632680724542DF22D6901986DDBE2BA7D3C999E67F3ED7B496CE8575BFDC
3668T6UV Series EN CPS setup.exeC:\Users\admin\AppData\Local\Temp\is-RJ1HB.tmp\T6UV Series EN CPS setup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
2248Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\settings.datbinary
MD5:3B2AEFD32F61DB8110091B81A16A9AD1
SHA256:27A6D2020F45CD9D3F4DFCF837EC661A1D997B08D23E3CB41B94186C21A50B37
2964T6UV Series EN CPS setup.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\T6UV Series EN CPS\Uninstall T6UV Series EN CPS.lnklnk
MD5:D61F7F5A2B4D7F83CF3FD73D18899436
SHA256:38E893894F5739EAAC43B2D680728E1789BB8DB5DC3C5218D80B8A5F2FA8CC72
2964T6UV Series EN CPS setup.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\T6UV Series EN CPS\T6UV Series EN CPS.lnklnk
MD5:6ACF01E5268B63CEEC9B20629E3044FB
SHA256:493E29DCF4B8973EB1A8726B4C8DFCC676B6ED392E106A2D23A5C089A5658BBC
2248Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.jsonbinary
MD5:15FFBD577E2DB92383D97BB38C2679C9
SHA256:F039FEFBCFF7337FFD69A20A18B59A792F18413EB38E72487FF99A2EA0AB9A7B
2964T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\unins000.exeexecutable
MD5:CD983F0B33227D008BE4124DE8B92FD2
SHA256:7904632680724542DF22D6901986DDBE2BA7D3C999E67F3ED7B496CE8575BFDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
296
DNS requests
386
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
7.74 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
9.17 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
45.3 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
6.54 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
9.81 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
88.1 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
177 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
118 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
729 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
binary
1.15 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2248
Skype.exe
52.113.194.133:443
get.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2248
Skype.exe
13.107.42.16:443
a.config.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2248
Skype.exe
23.200.212.163:443
download.skype.com
AKAMAI-AS
FR
unknown
3000
msedge.exe
239.255.255.250:1900
—
—
—
unknown
4012
msedge.exe
204.79.197.203:443
ntp.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4012
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
get.skype.com
  • 52.113.194.133
whitelisted
a.config.skype.com
  • 13.107.42.16
whitelisted
download.skype.com
  • 23.200.212.163
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.bing.com
  • 23.196.15.82
  • 23.196.15.33
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted
assets.msn.com
  • 23.196.15.41
  • 23.196.15.57
  • 23.196.15.59
whitelisted
clientservices.googleapis.com
  • 216.58.206.67
whitelisted

Threats

PID
Process
Class
Message
3224
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3224
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3224
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
Process
Message
Skype.exe
[0312/100417.437:ERROR:filesystem_win.cc(130)] GetFileAttributes C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\attachments\3a0ee62b-79ac-4cc3-bbd5-f65252e7a91f: The system cannot find the file specified. (0x2)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
T6UV Series EN CPS setup.exe