File name:

software_reporter_tool.exe

Full analysis: https://app.any.run/tasks/258380d5-5ac2-4680-b745-39e65c10c2f0
Verdict: Malicious activity
Analysis date: July 26, 2025, 06:25:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
aspack
upx
nspack
themida
golang
pecompact
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 14 sections
MD5:

2A91302BFE645CC3B7ED302FBB9C6940

SHA1:

89234BCCD1C8A511D59C60458754BC9488067039

SHA256:

664F9EA097D1992B28AFF370AB00E19F049D1E62CC2776E61B07BBE0C4364935

SSDEEP:

98304:Y1raPm9a21ixvgk7xT4sLM/HvuKwb1f8S3oKgMsUMnb3cdoAkWMBnvQIFYczf497:TYIH+B5xI8WfZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • software_reporter_tool.exe (PID: 4644)
      • updater.exe (PID: 3636)

    • Executable content was dropped or overwritten

      • software_reporter_tool.exe (PID: 2880)

    • The process executes via Task Scheduler

      • updater.exe (PID: 3636)

    • Detects driver loading without leaving file traces on disk (YARA)

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 4844)
      • software_reporter_tool.exe (PID: 2880)

    • Searches for installed software

      • software_reporter_tool.exe (PID: 2880)

  • INFO

    • Reads the computer name

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 2880)
      • software_reporter_tool.exe (PID: 4844)
      • updater.exe (PID: 3636)

    • The sample compiled with english language support

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 2880)

    • Checks supported languages

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 2880)
      • software_reporter_tool.exe (PID: 4844)
      • updater.exe (PID: 3636)
      • updater.exe (PID: 7020)

    • Creates files or folders in the user directory

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)

    • Create files in a temporary directory

      • software_reporter_tool.exe (PID: 2880)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 3636)

    • NsPack has been detected

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 2880)
      • software_reporter_tool.exe (PID: 4844)

    • Themida protector has been detected

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 2880)
      • software_reporter_tool.exe (PID: 4844)

    • Aspack has been detected

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 4844)
      • software_reporter_tool.exe (PID: 2880)

    • Application based on Golang

      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 2880)
      • software_reporter_tool.exe (PID: 4844)

    • PECompact has been detected (YARA)

      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 4844)
      • software_reporter_tool.exe (PID: 2880)

    • UPX packer has been detected

      • software_reporter_tool.exe (PID: 6508)
      • software_reporter_tool.exe (PID: 4644)
      • software_reporter_tool.exe (PID: 4844)
      • software_reporter_tool.exe (PID: 2880)

    • Checks proxy server information

      • slui.exe (PID: 2040)

    • Reads the software policy settings

      • slui.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2022:11:03 00:05:50+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 2680320
InitializedDataSize: 12373504
UninitializedDataSize: -
EntryPoint: 0x257720
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 107.294.200.0
ProductVersionNumber: 107.294.200.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google
FileDescription: Software Reporter Tool
FileVersion: 107.294.200
InternalName: software_reporter_tool_exe
LegalCopyright: Copyright 2015 Google Inc. All Rights Reserved.
OriginalFileName: software_reporter_tool.exe
ProductName: Software Reporter Tool
ProductVersion: 107.294.200
CompanyShortName: Google
ProductShortName: Software Reporter Tool
OfficialBuild: 1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start software_reporter_tool.exe no specs software_reporter_tool.exe software_reporter_tool.exe software_reporter_tool.exe no specs updater.exe no specs updater.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2040C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2880"c:\users\admin\appdata\local\temp\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4644_TCJFOMFQWZHCHVOL" --sandboxed-process-id=2 --init-done-notifier=840 --sandbox-mojo-pipe-token=16572450167346245896 --mojo-platform-channel-handle=816 --engine=2C:\Users\admin\AppData\Local\Temp\software_reporter_tool.exe
software_reporter_tool.exe
User:
admin
Company:
Google
Integrity Level:
MEDIUM
Description:
Software Reporter Tool
Exit code:
0
Version:
107.294.200
Modules
Images
c:\users\admin\appdata\local\temp\software_reporter_tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3636"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4644"C:\Users\admin\AppData\Local\Temp\software_reporter_tool.exe" C:\Users\admin\AppData\Local\Temp\software_reporter_tool.exe—explorer.exe
User:
admin
Company:
Google
Integrity Level:
MEDIUM
Description:
Software Reporter Tool
Exit code:
2
Version:
107.294.200
Modules
Images
c:\users\admin\appdata\local\temp\software_reporter_tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4844"c:\users\admin\appdata\local\temp\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4644_TCJFOMFQWZHCHVOL" --sandboxed-process-id=3 --init-done-notifier=1052 --sandbox-mojo-pipe-token=12398509952311319430 --mojo-platform-channel-handle=1048C:\Users\admin\AppData\Local\Temp\software_reporter_tool.exe—software_reporter_tool.exe
User:
admin
Company:
Google
Integrity Level:
MEDIUM
Description:
Software Reporter Tool
Exit code:
1
Version:
107.294.200
Modules
Images
c:\users\admin\appdata\local\temp\software_reporter_tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6508c:\users\admin\appdata\local\temp\software_reporter_tool.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2a0,0x2d0,0x7ff6b1c95960,0x7ff6b1c95970,0x7ff6b1c95980C:\Users\admin\AppData\Local\Temp\software_reporter_tool.exe
software_reporter_tool.exe
User:
admin
Company:
Google
Integrity Level:
MEDIUM
Description:
Software Reporter Tool
Exit code:
0
Version:
107.294.200
Modules
Images
c:\users\admin\appdata\local\temp\software_reporter_tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7020"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 696
Read events
3 685
Write events
9
Delete events
2

Modification events

(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool\ScanTimes
Operation:delete keyName:(default)
Value:
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:delete valueName:ExitCode
Value:
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:StartTime
Value:
7AF01B6965992F00
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:EngineErrorCode
Value:
65536
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:EngineErrorCode
Value:
589824
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:EngineErrorCode
Value:
655360
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:EngineErrorCode
Value:
917504
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:FoundUws
Value:
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:ExitCode
Value:
2
(PID) Process:(4644) software_reporter_tool.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Software Removal Tool
Operation:writeName:EndTime
Value:
13F92A6D65992F00
Executable files
7
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2880software_reporter_tool.exeC:\Users\admin\AppData\Local\Temp\em004_64.dllexecutable
MD5:EE46BEAA6C9244880E8A510D080B4416
SHA256:D4F17BD032EAD2A73340E6C14E24A3FA901D0FBAE78F49FE4D368A01B788B49C
2880software_reporter_tool.exeC:\Users\admin\AppData\Local\Temp\em005_64.dllexecutable
MD5:169A2EF320119891CF3189AA3FD23B0E
SHA256:1072D49DA0A70640FB9716CB894F4834FF621CA96D4AEA1F478754EDF4D0F780
4644software_reporter_tool.exeC:\Users\admin\AppData\Local\Google\Software Reporter Tool\settings.datbinary
MD5:A1D2E60440254B10ACBDE98A65B6B781
SHA256:3DE9C64176EF2250189A12D74BF6320D1C11709720533C6F588534F7F362569B
2880software_reporter_tool.exeC:\Users\admin\AppData\Local\Temp\em003_64.dllexecutable
MD5:7F3E3AB3E7F714DA01EC0F495982E8D4
SHA256:EBFEEAC7733A77A1E32995D638D67D2E05EEFDBB62782053D8354959E046D0FA
4844software_reporter_tool.exeC:\Users\admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.logtext
MD5:0D9136B6369630DFE333D12DDE789BF1
SHA256:8FFD1A92F8AB49C9DBABC6376B0A4409D13B01CA3486817EE69B935BB617D38C
7020updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:CEF7F97AED2C9470E01EBC3F77614E54
SHA256:80B7C73435624AEE16BF25BFB20A38FC997992E19EF629B2C9F475682A3169BD
4644software_reporter_tool.exeC:\Users\admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool.logtext
MD5:23703E176340C243AC7F7818D62269AB
SHA256:DFC860F4A83068E136B88DB381E3FAC20B83181A29770B94B0C8FCF079944C3D
6508software_reporter_tool.exeC:\Users\admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-crashpad.logtext
MD5:758D779887AAA3E13838CEAB8AC8F830
SHA256:2147F2C7E619BF355296BF65C90C88385674D38BA30E8829DBD6EE28BB5D18F9
2880software_reporter_tool.exeC:\Users\admin\AppData\Local\Temp\em000_64.dllexecutable
MD5:F8B7CAC6E9587BAABF4045C34890C7CE
SHA256:8B0613B91229C98DFA5398568A4FA40DDE2A2D40028654F74923BC929D6B5B30
2880software_reporter_tool.exeC:\Users\admin\AppData\Local\Temp\edls_64.dllexecutable
MD5:79D7F318441C21D17739E43990697D1D
SHA256:0CE49DC9F71360BF9DD21B8E3AF4641834F85EED7D80A7DE0940508437E68970
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2064
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
684
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
684
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
984
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
984
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3480
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2064
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.4
  • 20.190.160.131
  • 20.190.160.3
  • 40.126.32.76
  • 20.190.160.22
  • 20.190.160.64
  • 40.126.32.68
  • 20.190.160.66
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.20
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
self.events.data.microsoft.com
  • 20.189.173.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
software_reporter_tool.exe
[0726/062539.742:ERROR:file_io.cc(94)] ReadExactly: expected 36, observed 0
software_reporter_tool.exe
[0726/062539.742:ERROR:file_io.cc(94)] ReadExactly: expected 36, observed 0
software_reporter_tool.exe
[0726/062540.507:ERROR:file_io.cc(94)] ReadExactly: expected 36, observed 0
software_reporter_tool.exe
[0726/062540.507:ERROR:file_io.cc(94)] ReadExactly: expected 36, observed 0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
software_reporter_tool.exe