File name:

CDM2123620_Setup.exe

Full analysis: https://app.any.run/tasks/0b735652-0f0d-49fd-ac44-5af272211e78
Verdict: Malicious activity
Analysis date: September 11, 2025, 12:19:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A7A0503C8CF2BB2B03B49AE37971DAAC

SHA1:

A6F9831AF2BF61A3532453F8E1A9F9284D444AFD

SHA256:

6B4985913C5F8B0B9656E8BAA6F1193B2B7EF3385F67DDC09FBA83A670B5444D

SSDEEP:

98304:AwgZ1fB3ZmC0WDb7j8GnXmoFwlA5nm7mh9+gwRnJYS6enSwQjOZNn6gzywGpFhLp:AmCwosBS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • dp-chooser.exe (PID: 4912)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CDM2123620_Setup.exe (PID: 1976)
      • drvinst.exe (PID: 6788)
      • dpinst-amd64.exe (PID: 6808)
      • drvinst.exe (PID: 6796)

    • Drops a system driver (possible attempt to evade defenses)

      • CDM2123620_Setup.exe (PID: 1976)
      • drvinst.exe (PID: 6796)
      • dpinst-amd64.exe (PID: 6808)
      • drvinst.exe (PID: 6788)

    • There is functionality for taking screenshot (YARA)

      • CDM2123620_Setup.exe (PID: 1976)

    • Process drops legitimate windows executable

      • CDM2123620_Setup.exe (PID: 1976)

    • Starts a Microsoft application from unusual location

      • dpinst-amd64.exe (PID: 6808)

    • Creates files in the driver directory

      • drvinst.exe (PID: 6796)
      • drvinst.exe (PID: 6788)

  • INFO

    • Create files in a temporary directory

      • CDM2123620_Setup.exe (PID: 1976)
      • dpinst-amd64.exe (PID: 6808)

    • Checks supported languages

      • CDM2123620_Setup.exe (PID: 1976)
      • dpinst-amd64.exe (PID: 6808)
      • drvinst.exe (PID: 6788)
      • drvinst.exe (PID: 6796)
      • dp-chooser.exe (PID: 4912)

    • The sample compiled with english language support

      • CDM2123620_Setup.exe (PID: 1976)
      • dpinst-amd64.exe (PID: 6808)
      • drvinst.exe (PID: 6796)
      • drvinst.exe (PID: 6788)

    • Reads the computer name

      • CDM2123620_Setup.exe (PID: 1976)
      • dpinst-amd64.exe (PID: 6808)
      • drvinst.exe (PID: 6796)
      • drvinst.exe (PID: 6788)

    • The sample compiled with arabic language support

      • CDM2123620_Setup.exe (PID: 1976)

    • Reads the software policy settings

      • drvinst.exe (PID: 6796)
      • drvinst.exe (PID: 6788)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 6796)
      • drvinst.exe (PID: 6788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:03:17 12:31:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 24064
InitializedDataSize: 66560
UninitializedDataSize: -
EntryPoint: 0x6700
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
7
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cdm2123620_setup.exe dp-chooser.exe no specs dpinst-amd64.exe drvinst.exe drvinst.exe slui.exe no specs cdm2123620_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1976"C:\Users\admin\AppData\Local\Temp\CDM2123620_Setup.exe" C:\Users\admin\AppData\Local\Temp\CDM2123620_Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\cdm2123620_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4444"C:\Users\admin\AppData\Local\Temp\CDM2123620_Setup.exe" C:\Users\admin\AppData\Local\Temp\CDM2123620_Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\cdm2123620_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4512C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4912C:\Users\admin\AppData\Local\Temp\FTDI-Driver\dp-chooser.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dp-chooser.exe—CDM2123620_Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ftdi-driver\dp-chooser.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6788DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{6c434fd4-6652-164a-8f8a-0781e4bd1297}\ftdiport.inf" "9" "461a5a59f" "00000000000001D4" "WinSta0\Default" "00000000000001F0" "208" "c:\users\admin\appdata\local\temp\ftdi-driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6796DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{9bc9b013-5c4c-434f-ab8d-c9e27e4fa7a0}\ftdibus.inf" "9" "4a9ba6403" "0000000000000174" "WinSta0\Default" "00000000000001D4" "208" "c:\users\admin\appdata\local\temp\ftdi-driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6808C:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-amd64.exe /saC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-amd64.exe
dp-chooser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
512
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\ftdi-driver\dpinst-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
6 352
Read events
6 351
Write events
1
Delete events
0

Modification events

(PID) Process:(6808) dpinst-amd64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
Executable files
50
Suspicious files
14
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FECCE0.tmptext
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\FTD2XX64.dllexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftlang.dllexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftser2k.sysexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dp-chooser.exeexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftdibus.sysexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-amd64.exeexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-x86.exeexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftserui2.dllexecutable
MD5:—
SHA256:—
1976CDM2123620_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\ftdibus.inftext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3092
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6724
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4084
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6724
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1636
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3092
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3092
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.17:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.32.97.216:80
www.microsoft.com
AKAMAI-AS
SE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.206
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.131
  • 20.190.160.64
  • 20.190.160.20
  • 20.190.160.130
  • 40.126.32.136
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 23.216.77.17
  • 23.216.77.20
  • 23.216.77.22
  • 23.216.77.43
  • 23.216.77.7
  • 23.216.77.5
  • 23.216.77.18
  • 23.216.77.10
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.32.97.216
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CDM2123620_Setup.exe