File name:

BRU_setup_3.4.4.0.exe

Full analysis: https://app.any.run/tasks/dd544bd0-9bf5-4c7c-8c20-f8e9bd8d0fae
Verdict: Malicious activity
Analysis date: June 27, 2024, 14:46:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5759737C14E258F5F03D738370D38F3B

SHA1:

7461BFA2BAD9A3FEB57190CCA4ABA1856BE591D1

SHA256:

6359D8F55FEEB92648B15FFFA44BED2994FF1DAA3D9D38AB45AD00799050F3D6

SSDEEP:

98304:66wO1tsqsYOSoai61LVCfHD3ENZaWeAokZb6rLiclEDW+RWamrdO/K2wphnBCdQZ:vJgBFAFzTKKKkARDEbKkFWUAJmU0S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BRU_setup_3.4.4.0.exe (PID: 4268)
      • BRU_setup_3.4.4.0.exe (PID: 1088)
      • BRU_setup_3.4.4.0.tmp (PID: 2568)

    • Registers / Runs the DLL via REGSVR32.EXE

      • BRU_setup_3.4.4.0.tmp (PID: 2568)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BRU_setup_3.4.4.0.exe (PID: 4268)
      • BRU_setup_3.4.4.0.exe (PID: 1088)
      • BRU_setup_3.4.4.0.tmp (PID: 2568)

    • Reads security settings of Internet Explorer

      • BRU_setup_3.4.4.0.tmp (PID: 3128)

    • Reads the date of Windows installation

      • BRU_setup_3.4.4.0.tmp (PID: 3128)

    • Process drops legitimate windows executable

      • BRU_setup_3.4.4.0.tmp (PID: 2568)

    • Reads the Windows owner or organization settings

      • BRU_setup_3.4.4.0.tmp (PID: 2568)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1492)

  • INFO

    • Checks supported languages

      • BRU_setup_3.4.4.0.exe (PID: 4268)
      • BRU_setup_3.4.4.0.tmp (PID: 3128)
      • BRU_setup_3.4.4.0.exe (PID: 1088)
      • BRU_setup_3.4.4.0.tmp (PID: 2568)
      • setacl.exe (PID: 1320)
      • Bulk Rename Utility.exe (PID: 2476)

    • Reads the computer name

      • BRU_setup_3.4.4.0.tmp (PID: 3128)
      • BRU_setup_3.4.4.0.tmp (PID: 2568)
      • Bulk Rename Utility.exe (PID: 2476)

    • Create files in a temporary directory

      • BRU_setup_3.4.4.0.exe (PID: 4268)
      • BRU_setup_3.4.4.0.exe (PID: 1088)
      • BRU_setup_3.4.4.0.tmp (PID: 2568)

    • Process checks computer location settings

      • BRU_setup_3.4.4.0.tmp (PID: 3128)

    • Creates a software uninstall entry

      • BRU_setup_3.4.4.0.tmp (PID: 2568)

    • Creates files in the program directory

      • BRU_setup_3.4.4.0.tmp (PID: 2568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:01:15 08:22:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 73728
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.4.4.0
ProductVersionNumber: 3.4.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: TGRMN Software
FileDescription: Bulk Rename Utility Setup
FileVersion: Bulk Rename Utility
LegalCopyright: TGRMN Software
ProductName: Bulk Rename Utility
ProductVersion: 3.4.4.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bru_setup_3.4.4.0.exe bru_setup_3.4.4.0.tmp no specs bru_setup_3.4.4.0.exe bru_setup_3.4.4.0.tmp regsvr32.exe no specs setacl.exe no specs conhost.exe no specs bulk rename utility.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1088"C:\Users\admin\AppData\Local\Temp\BRU_setup_3.4.4.0.exe" /SPAWNWND=$30232 /NOTIFYWND=$402C2 C:\Users\admin\AppData\Local\Temp\BRU_setup_3.4.4.0.exe
BRU_setup_3.4.4.0.tmp
User:
admin
Company:
TGRMN Software
Integrity Level:
HIGH
Description:
Bulk Rename Utility Setup
Exit code:
0
Version:
Bulk Rename Utility
Modules
Images
c:\users\admin\appdata\local\temp\bru_setup_3.4.4.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—setacl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1320"C:\Users\admin\AppData\Local\Temp\is-943A0.tmp\setacl.exe" "C:\Program Files\Bulk Rename Utility\Bulk Rename Utility.ini" /file /grant S-1-1-0 /full /sid /silentC:\Users\admin\AppData\Local\Temp\is-943A0.tmp\setacl.exe—BRU_setup_3.4.4.0.tmp
User:
admin
Company:
Helge Klein
Integrity Level:
HIGH
Description:
SetACL
Exit code:
0
Version:
0, 9, 0, 4
Modules
Images
c:\users\admin\appdata\local\temp\is-943a0.tmp\setacl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1492"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Bulk Rename Utility\BRUhere64.dll"C:\Windows\System32\regsvr32.exe—BRU_setup_3.4.4.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2476"C:\Program Files\Bulk Rename Utility\Bulk Rename Utility.exe"C:\Program Files\Bulk Rename Utility\Bulk Rename Utility.exe—BRU_setup_3.4.4.0.tmp
User:
admin
Company:
TGRMN Software
Integrity Level:
MEDIUM
Description:
Bulk Rename Utility 64-bit
Version:
3.4.4.0
Modules
Images
c:\program files\bulk rename utility\bulk rename utility.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2568"C:\Users\admin\AppData\Local\Temp\is-DO0DD.tmp\BRU_setup_3.4.4.0.tmp" /SL5="$302C0,10502724,139776,C:\Users\admin\AppData\Local\Temp\BRU_setup_3.4.4.0.exe" /SPAWNWND=$30232 /NOTIFYWND=$402C2 C:\Users\admin\AppData\Local\Temp\is-DO0DD.tmp\BRU_setup_3.4.4.0.tmp
BRU_setup_3.4.4.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-do0dd.tmp\bru_setup_3.4.4.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3128"C:\Users\admin\AppData\Local\Temp\is-60FVG.tmp\BRU_setup_3.4.4.0.tmp" /SL5="$402C2,10502724,139776,C:\Users\admin\AppData\Local\Temp\BRU_setup_3.4.4.0.exe" C:\Users\admin\AppData\Local\Temp\is-60FVG.tmp\BRU_setup_3.4.4.0.tmp—BRU_setup_3.4.4.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-60fvg.tmp\bru_setup_3.4.4.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4268"C:\Users\admin\AppData\Local\Temp\BRU_setup_3.4.4.0.exe" C:\Users\admin\AppData\Local\Temp\BRU_setup_3.4.4.0.exe
explorer.exe
User:
admin
Company:
TGRMN Software
Integrity Level:
MEDIUM
Description:
Bulk Rename Utility Setup
Exit code:
0
Version:
Bulk Rename Utility
Modules
Images
c:\users\admin\appdata\local\temp\bru_setup_3.4.4.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
7 799
Read events
7 769
Write events
30
Delete events
0

Modification events

(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BRUfile
Operation:writeName:AlwaysShowExt
Value:
,0
(PID) Process:(1492) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D924130-4CB1-11DB-B0DE-0800200C9A66}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(1492) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{5D924130-4CB1-11DB-B0DE-0800200C9A66}
Value:
BRU context menu handler
(PID) Process:(1492) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
17
(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Rename Utility Installation_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.8 (u)
(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Rename Utility Installation_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Bulk Rename Utility
(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Rename Utility Installation_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Bulk Rename Utility\
(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Rename Utility Installation_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Bulk Rename Utility
(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Rename Utility Installation_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2568) BRU_setup_3.4.4.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Rename Utility Installation_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
shellext,samples
Executable files
12
Suspicious files
9
Text files
18
Unknown types
3

Dropped files

PID
Process
Filename
Type
4268BRU_setup_3.4.4.0.exeC:\Users\admin\AppData\Local\Temp\is-60FVG.tmp\BRU_setup_3.4.4.0.tmpexecutable
MD5:6A82AA7A874FAA628F5D30D6BCA24DB2
SHA256:5C771DFC77CF20573494124627362ACEA3A62323D4DAC982EAF44DB5E44B14CA
1088BRU_setup_3.4.4.0.exeC:\Users\admin\AppData\Local\Temp\is-DO0DD.tmp\BRU_setup_3.4.4.0.tmpexecutable
MD5:6A82AA7A874FAA628F5D30D6BCA24DB2
SHA256:5C771DFC77CF20573494124627362ACEA3A62323D4DAC982EAF44DB5E44B14CA
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\is-UGO6G.tmppdf
MD5:A86DB6765BB3B153BC656CAC52B18E85
SHA256:CEF5CC55DF9EBAF97C816CFF6C185A5D9A452652FEF8877DE9CA5943C7B54FC7
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\is-CSKUG.tmpexecutable
MD5:18D7E76D1B0FF8BD6D85537DABF84B63
SHA256:1B309FA7426991FF23B101F9FF8FF3CDDBC731B09D96C968D9AA8F39E8B3DEF1
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\is-MKIV6.tmpbinary
MD5:8E4B12855D0EE3D780916C13F6573F0B
SHA256:53B7FC4EA089ABEB4616132F06D79785A57532BD958D15F7BB21C04A4502400F
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\unins000.exeexecutable
MD5:18D7E76D1B0FF8BD6D85537DABF84B63
SHA256:1B309FA7426991FF23B101F9FF8FF3CDDBC731B09D96C968D9AA8F39E8B3DEF1
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\Bulk Rename Utility.chmbinary
MD5:8E4B12855D0EE3D780916C13F6573F0B
SHA256:53B7FC4EA089ABEB4616132F06D79785A57532BD958D15F7BB21C04A4502400F
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\is-U0E5R.tmpexecutable
MD5:8165488B3EA3DA912B577E5BACAD3B95
SHA256:13733452162F5E5184C4C908BC27B35692D8736B05356054D1AB103BE2ECCCAB
2568BRU_setup_3.4.4.0.tmpC:\Program Files\Bulk Rename Utility\is-GBNND.tmptext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
2568BRU_setup_3.4.4.0.tmpC:\Users\admin\AppData\Local\Temp\is-943A0.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
63
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5188
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
2364
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2364
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
696
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5784
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2848
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6004
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
4656
SearchApp.exe
184.86.251.23:443
r.bing.com
Akamai International B.V.
DE
unknown
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.71
  • 40.126.31.69
whitelisted
r.bing.com
  • 184.86.251.23
  • 184.86.251.18
  • 184.86.251.21
  • 184.86.251.8
  • 184.86.251.16
  • 184.86.251.13
  • 184.86.251.6
  • 184.86.251.9
  • 184.86.251.19
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
self.events.data.microsoft.com
  • 52.168.117.170
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BRU_setup_3.4.4.0.exe