File name:

neighbours-from-hell-2-demo-installer_hM5X-Y1.exe

Full analysis: https://app.any.run/tasks/19732a42-58d9-44b2-b922-a80a41e31727
Verdict: Malicious activity
Analysis date: July 09, 2025, 01:33:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
arch-exec
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

DAA11CECD93404B9862A9577BB588E4C

SHA1:

E99B1A7BFAF063521F5741406CE2D3214DB49BE4

SHA256:

6F0050AA136F509E07669B49BAE75CA9B2652169B24C06A2815721774D2E7BEE

SSDEEP:

24576:+7FUDowAyrTVE3U5FmRz1LpoXJYBU/nNEIQioPTd3aANWc9HQC72l:+BuZrEUiy5liIQiaTd3aIXFvi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 5480)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 768)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 856)
      • installer.exe (PID: 1732)

    • Reads security settings of Internet Explorer

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 440)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 1732)
      • uihost.exe (PID: 5744)

    • Reads the Windows owner or organization settings

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 4724)
      • servicehost.exe (PID: 4808)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 856)
      • installer.exe (PID: 1732)
      • uihost.exe (PID: 5744)
      • servicehost.exe (PID: 4808)
      • updater.exe (PID: 6948)
      • cmd.exe (PID: 4700)
      • cmd.exe (PID: 4312)

    • Executes application which crashes

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)

    • Process drops legitimate windows executable

      • installer.exe (PID: 1732)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 1732)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 1732)

    • Creates a software uninstall entry

      • installer.exe (PID: 1732)
      • servicehost.exe (PID: 4808)

    • Executes as Windows Service

      • servicehost.exe (PID: 4808)

    • Reads Mozilla Firefox installation path

      • uihost.exe (PID: 5744)
      • servicehost.exe (PID: 4808)

    • Searches for installed software

      • updater.exe (PID: 6948)

    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 6948)

  • INFO

    • Create files in a temporary directory

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 5480)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 768)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 1732)

    • Checks supported languages

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 5480)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 440)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 768)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • installer.exe (PID: 856)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 1732)
      • servicehost.exe (PID: 4808)
      • uihost.exe (PID: 5744)
      • updater.exe (PID: 6948)

    • Reads the computer name

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 440)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 1732)
      • servicehost.exe (PID: 4808)
      • uihost.exe (PID: 5744)
      • updater.exe (PID: 6948)

    • Process checks computer location settings

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 440)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • uihost.exe (PID: 5744)
      • servicehost.exe (PID: 4808)

    • Detects InnoSetup installer (YARA)

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 5480)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 440)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 768)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)

    • Compiled with Borland Delphi (YARA)

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 5480)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 440)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.exe (PID: 768)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)

    • Reads the software policy settings

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 1732)
      • WerFault.exe (PID: 6664)
      • WerFault.exe (PID: 3476)
      • servicehost.exe (PID: 4808)
      • uihost.exe (PID: 5744)
      • updater.exe (PID: 6948)

    • Reads the machine GUID from the registry

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 1732)
      • servicehost.exe (PID: 4808)
      • uihost.exe (PID: 5744)
      • updater.exe (PID: 6948)

    • Checks proxy server information

      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • WerFault.exe (PID: 6664)
      • WerFault.exe (PID: 3476)

    • Creates files in the program directory

      • saBSI.exe (PID: 4724)
      • saBSI.exe (PID: 3844)
      • installer.exe (PID: 856)
      • installer.exe (PID: 1732)
      • servicehost.exe (PID: 4808)
      • uihost.exe (PID: 5744)

    • The sample compiled with english language support

      • saBSI.exe (PID: 4724)
      • neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp (PID: 5340)
      • installer.exe (PID: 856)
      • installer.exe (PID: 1732)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6664)
      • WerFault.exe (PID: 3476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 611.235.1148.1160
ProductVersionNumber: 611.235.1148.1160
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Softonîc Internåtional SA
FileVersion: 611.235.1148.1160
LegalCopyright: ©2023 Softonîc Internåtional SA
OriginalFileName:
ProductName: Softonîc Internåtional SA
ProductVersion: 611.235.1148.1160
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
18
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start neighbours-from-hell-2-demo-installer_hm5x-y1.exe no specs neighbours-from-hell-2-demo-installer_hm5x-y1.tmp no specs neighbours-from-hell-2-demo-installer_hm5x-y1.exe neighbours-from-hell-2-demo-installer_hm5x-y1.tmp sabsi.exe sabsi.exe werfault.exe installer.exe no specs installer.exe werfault.exe servicehost.exe uihost.exe no specs updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Users\admin\AppData\Local\Temp\is-JR4K8.tmp\neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp" /SL5="$6025A,836424,832512,C:\Users\admin\AppData\Local\Temp\neighbours-from-hell-2-demo-installer_hM5X-Y1.exe" C:\Users\admin\AppData\Local\Temp\is-JR4K8.tmp\neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp—neighbours-from-hell-2-demo-installer_hM5X-Y1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jr4k8.tmp\neighbours-from-hell-2-demo-installer_hm5x-y1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
768"C:\Users\admin\AppData\Local\Temp\neighbours-from-hell-2-demo-installer_hM5X-Y1.exe" /SPAWNWND=$40252 /NOTIFYWND=$6025A C:\Users\admin\AppData\Local\Temp\neighbours-from-hell-2-demo-installer_hM5X-Y1.exe
neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Softonîc Internåtional SA
Exit code:
3221226525
Version:
611.235.1148.1160
Modules
Images
c:\users\admin\appdata\local\temp\neighbours-from-hell-2-demo-installer_hm5x-y1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
856"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe—saBSI.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1732"C:\Program Files\McAfee\Temp3751307575\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\Program Files\McAfee\Temp3751307575\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,1054
Modules
Images
c:\program files\mcafee\temp3751307575\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\user32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\win32u.dll
2072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3476C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5340 -s 2052C:\Windows\SysWOW64\WerFault.exe
neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3716C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3844"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW0t7MAE5A3VdpUa2B2Tldx90gy6hEnoD77RCTUNzQavCV0ACWJnA8XtFdqF3bnJz30ipiwONseXCcHqq saBsiVersion=4.1.1.865 CountryCode=DE /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
0
Version:
4,1,1,1006
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4312C:\WINDOWS\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )C:\Windows\System32\cmd.exe—updater.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
33 272
Read events
33 031
Write events
228
Delete events
13

Modification events

(PID) Process:(5340) neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E907070003000900010022000700F302010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(4724) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:UUID
Value:
{987D0A17-4A22-4CAD-96FF-46BCA2BA99FF}
(PID) Process:(4724) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallerFlags
Value:
1
(PID) Process:(4724) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Value:
(PID) Process:(4724) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Operation:writeName:Blob
Value:
040000000100000010000000E94FB54871208C00DF70F708AC47085B0F0000000100000030000000C130BBA37B8B350E89FD5ED76B4F78777FEEE220D3B9E729042BEF6AF46E8E4C1B252E32B3080C681BC9A8A1AFDD0A3C0300000001000000140000004EFC31460C619ECAE59C1BCE2C008036D94C84B809000000010000000C000000300A06082B060105050703031D00000001000000100000005467B0ADDE8D858E30EE517B1A19ECD91400000001000000140000001F00BF46800AFC7839B7A5B443D95650BBCE963B53000000010000001F000000301D301B060567810C010330123010060A2B0601040182373C0101030200C06200000001000000200000007B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF860B000000010000004200000047006C006F00620061006C005300690067006E00200043006F006400650020005300690067006E0069006E006700200052006F006F007400200052003400350000001900000001000000100000005D1B8FF2C30F63F5B536EDD400F7F9B4200000000100000076050000308205723082035AA00302010202107653FEAC75464893F5E5D74A483A4EF8300D06092A864886F70D01010C05003053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F7420523435301E170D3230303331383030303030305A170D3435303331383030303030305A3053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F742052343530820222300D06092A864886F70D01010105000382020F003082020A0282020100B62DC530DD7AE8AB903D0372B03A4B991661B2E5FFA5671D371CE57EEC9383AA84F5A3439B98458AB863575D9B00880425E9F868924B82D84BC94A03F3A87F6A8F8A6127BDA144D0FDF53F22C2A34F918DB305B22882915DFB5988050B9706C298F82CA73324EE503A41CCF0A0B07B1D4DD2A8583896E9DFF91B91BB8B102CD2C7431DA20974A180AF7BE6330A0C596B8EBCF4AB5A977B7FAE55FB84F080FE844CD7E2BABDC475A16FBD61107444B29807E274ABFF68DC6C263EE91FE5E00487AD30D30C8D037C55B816705C24782025EB676788ABBA4E34986B7011DE38CAD4BEA1C09CE1DF1E0201D83BE1674384B6CFFC74B72F84A3BFBA09373D676CB1455C1961AB4183F5AC1DEB770D464773CEBFBD9595ED9D2B8810FEFA58E8A757E1B3CFA85AE907259B12C49E80723D93DC8C94DF3B44E62680FCD2C303F08C0CD245D62EE78F989EE604EE426E677E42167162E704F960C664A1B69C81214E2BC66D689486C699747367317A91F2D48C796E7CA6BB7E466F4DC585122BCF9A224408A88537CE07615706171224C0C43173A1983557477E103A45D92DA4519098A9A00737C4651AAA1C6B1677F7A797EC3F1930996F31FBEA40B2E7D2C4FAC9D0F050767459FA8D6D1732BEF8E97E03F4E787759AD44A912C850313022B4280F2896A36CFC84CA0CE9EF8CB8DAD16A7D3DED59B18A7C6923AF18263F12E0E2464DF0203010001A3423040300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E041604141F00BF46800AFC7839B7A5B443D95650BBCE963B300D06092A864886F70D01010C050003820201005E2BBA749734445F764828408493EE016EE9A1B3D68025E67BE4BC09913D0FFC76ADD7D43020BB8F60D091D61CF29CEF781A2B943202C12496525202D0F3D1FCF29B396E99E11F8E43417D9A1E5BC95D9A84FC26E687F3747226ADA41BD93D3B6A52A03C091E2F1E7BB333B445C7F7ACB1AF9360AD76AEB8B21578EB836AEBFFDB46AB24E5EE02FA901F59C02F5DD6B75DA45C10B77253F8414ECCFA781A254ACAFE85624361C3B437AA81D2F4D63A0FBD8D597E3047DE2B6BE72150335FD4679BD4B8679F3C279903FF85438E7312CA20CDE861D5B166DC17D6396D0FDBCF2337A182894E1C6B3FD6A0CDAA079D3E4226AAD70CEEFA47BF1A527ED17581D3C98A62176D4F88A021A0263EAF6DD962301FE99828AE6E8DD58E4C726693808D2AE355C760679042565C22510FB3DC4E39EE4DDDD91D7810543B6ED0976F03B51EB22373C612B29A64D0FC958524A8FFDFA1B0DC9140AEDF0933ABB9DD92B7F1CC91743B69EB67971B90BFE7C7A06F71BB57BFB78F5AED7A406A16CD80842D2FE102D4249443B315FC0C2B1BFD716FFCCBBC75173A5E83D2C9B32F1BD59C8D7F54FE7E7EE456A387A79DE1595294418F6D5BBE86959AFF1A76DD40D2514A70B41F336323773FEC271E59E40887ED34824A0F3FFEA01DC1F56773458678F4AA29E92787C619DBC61314C33949874DA097E06513F59D7756E9DAB358C73AF2C0CD82
(PID) Process:(4724) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Operation:writeName:Blob
Value:
5C0000000100000004000000001000001900000001000000100000005D1B8FF2C30F63F5B536EDD400F7F9B40B000000010000004200000047006C006F00620061006C005300690067006E00200043006F006400650020005300690067006E0069006E006700200052006F006F007400200052003400350000006200000001000000200000007B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF8653000000010000001F000000301D301B060567810C010330123010060A2B0601040182373C0101030200C01400000001000000140000001F00BF46800AFC7839B7A5B443D95650BBCE963B1D00000001000000100000005467B0ADDE8D858E30EE517B1A19ECD909000000010000000C000000300A06082B060105050703030300000001000000140000004EFC31460C619ECAE59C1BCE2C008036D94C84B80F0000000100000030000000C130BBA37B8B350E89FD5ED76B4F78777FEEE220D3B9E729042BEF6AF46E8E4C1B252E32B3080C681BC9A8A1AFDD0A3C040000000100000010000000E94FB54871208C00DF70F708AC47085B200000000100000076050000308205723082035AA00302010202107653FEAC75464893F5E5D74A483A4EF8300D06092A864886F70D01010C05003053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F7420523435301E170D3230303331383030303030305A170D3435303331383030303030305A3053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F742052343530820222300D06092A864886F70D01010105000382020F003082020A0282020100B62DC530DD7AE8AB903D0372B03A4B991661B2E5FFA5671D371CE57EEC9383AA84F5A3439B98458AB863575D9B00880425E9F868924B82D84BC94A03F3A87F6A8F8A6127BDA144D0FDF53F22C2A34F918DB305B22882915DFB5988050B9706C298F82CA73324EE503A41CCF0A0B07B1D4DD2A8583896E9DFF91B91BB8B102CD2C7431DA20974A180AF7BE6330A0C596B8EBCF4AB5A977B7FAE55FB84F080FE844CD7E2BABDC475A16FBD61107444B29807E274ABFF68DC6C263EE91FE5E00487AD30D30C8D037C55B816705C24782025EB676788ABBA4E34986B7011DE38CAD4BEA1C09CE1DF1E0201D83BE1674384B6CFFC74B72F84A3BFBA09373D676CB1455C1961AB4183F5AC1DEB770D464773CEBFBD9595ED9D2B8810FEFA58E8A757E1B3CFA85AE907259B12C49E80723D93DC8C94DF3B44E62680FCD2C303F08C0CD245D62EE78F989EE604EE426E677E42167162E704F960C664A1B69C81214E2BC66D689486C699747367317A91F2D48C796E7CA6BB7E466F4DC585122BCF9A224408A88537CE07615706171224C0C43173A1983557477E103A45D92DA4519098A9A00737C4651AAA1C6B1677F7A797EC3F1930996F31FBEA40B2E7D2C4FAC9D0F050767459FA8D6D1732BEF8E97E03F4E787759AD44A912C850313022B4280F2896A36CFC84CA0CE9EF8CB8DAD16A7D3DED59B18A7C6923AF18263F12E0E2464DF0203010001A3423040300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E041604141F00BF46800AFC7839B7A5B443D95650BBCE963B300D06092A864886F70D01010C050003820201005E2BBA749734445F764828408493EE016EE9A1B3D68025E67BE4BC09913D0FFC76ADD7D43020BB8F60D091D61CF29CEF781A2B943202C12496525202D0F3D1FCF29B396E99E11F8E43417D9A1E5BC95D9A84FC26E687F3747226ADA41BD93D3B6A52A03C091E2F1E7BB333B445C7F7ACB1AF9360AD76AEB8B21578EB836AEBFFDB46AB24E5EE02FA901F59C02F5DD6B75DA45C10B77253F8414ECCFA781A254ACAFE85624361C3B437AA81D2F4D63A0FBD8D597E3047DE2B6BE72150335FD4679BD4B8679F3C279903FF85438E7312CA20CDE861D5B166DC17D6396D0FDBCF2337A182894E1C6B3FD6A0CDAA079D3E4226AAD70CEEFA47BF1A527ED17581D3C98A62176D4F88A021A0263EAF6DD962301FE99828AE6E8DD58E4C726693808D2AE355C760679042565C22510FB3DC4E39EE4DDDD91D7810543B6ED0976F03B51EB22373C612B29A64D0FC958524A8FFDFA1B0DC9140AEDF0933ABB9DD92B7F1CC91743B69EB67971B90BFE7C7A06F71BB57BFB78F5AED7A406A16CD80842D2FE102D4249443B315FC0C2B1BFD716FFCCBBC75173A5E83D2C9B32F1BD59C8D7F54FE7E7EE456A387A79DE1595294418F6D5BBE86959AFF1A76DD40D2514A70B41F336323773FEC271E59E40887ED34824A0F3FFEA01DC1F56773458678F4AA29E92787C619DBC61314C33949874DA097E06513F59D7756E9DAB358C73AF2C0CD82
(PID) Process:(3844) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallationStatus
Value:
PENDING
(PID) Process:(3844) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor\Settings
Operation:writeName:*Affid
Value:
SYSTEM,STR,91082
(PID) Process:(3844) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallationID
Value:
GnjW0t7MAE5A3VdpUa2B2Tldx90gy6hEnoD77RCTUNzQavCV0ACWJnA8XtFdqF3bnJz30ipiwONseXCcHqq
(PID) Process:(3844) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:CountryCode
Value:
DE
Executable files
24
Suspicious files
191
Text files
685
Unknown types
25

Dropped files

PID
Process
Filename
Type
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\is-IEOJ5.tmp —
MD5:—
SHA256:—
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\is-NDAV0.tmp —
MD5:—
SHA256:—
856installer.exeC:\Program Files\McAfee\Temp3751307575\browserplugin.cab —
MD5:—
SHA256:—
768neighbours-from-hell-2-demo-installer_hM5X-Y1.exeC:\Users\admin\AppData\Local\Temp\is-FHMHQ.tmp\neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpexecutable
MD5:F668749B4CC9447266008783FEE89894
SHA256:C92E84EA1DD0340C2683FF3102F26E48BDDCE54D8424F68FA86D550666A30235
5480neighbours-from-hell-2-demo-installer_hM5X-Y1.exeC:\Users\admin\AppData\Local\Temp\is-JR4K8.tmp\neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpexecutable
MD5:F668749B4CC9447266008783FEE89894
SHA256:C92E84EA1DD0340C2683FF3102F26E48BDDCE54D8424F68FA86D550666A30235
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0.zipcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\is-0RIVF.tmpcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\WebAdvisor.pngimage
MD5:5FD73821F3F097D177009D88DFD33605
SHA256:A6ECCE54116936CA27D4BE9797E32BF2F3CFC7E41519A23032992970FBD9D3BA
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0compressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
5340neighbours-from-hell-2-demo-installer_hM5X-Y1.tmpC:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\x_in_black_circle.pngimage
MD5:A1ADA7C652B432159B63A7FFE0A64AE3
SHA256:A58DBCF8B632E9B5D27949A5E869902A241BB8FABBDFC35CB6FF05C4C60B38E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.14:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2464
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6664
WerFault.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6664
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3620
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3620
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5060
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.241.14:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5340
neighbours-from-hell-2-demo-installer_hM5X-Y1.tmp
18.245.33.129:443
d3tq7gtaad4z5i.cloudfront.net
—
US
whitelisted
2464
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.241.14
  • 2.16.241.12
  • 2.20.245.139
  • 2.20.245.136
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
d3tq7gtaad4z5i.cloudfront.net
  • 18.245.33.129
  • 18.245.33.170
  • 18.245.33.188
  • 18.245.33.231
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.129
  • 40.126.31.130
  • 40.126.31.3
  • 40.126.31.128
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
images.sftcdn.net
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.129.91
  • 151.101.193.91
whitelisted
gsf-lu.softonic.com
  • —
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-2VPNK.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
neighbours-from-hell-2-demo-installer_hM5X-Y1.exe