File name:

eyeBeam_setup.exe

Full analysis: https://app.any.run/tasks/26120e6a-3ab3-432b-80e7-f4246209dce7
Verdict: Malicious activity
Analysis date: April 16, 2025, 19:31:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

6ADDEB5601F354B6D8F0811752D16BEB

SHA1:

7BA3CAE11715F2DCE0E4036C386B02883925CB3F

SHA256:

77260EE9B843E24B52FC3DAA5BE8EA276BBC29D9741CC1858302C0983AEE53D7

SSDEEP:

98304:Gkx9EJiIGq0U7pfwb8478EkwM5wWN7phR85782xv8ZC38hlJ2bpDGBc5k23uQOjV:7CugdJ+K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • is-ALI05.tmp (PID: 7228)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • eyeBeam_setup.exe (PID: 7208)
      • is-ALI05.tmp (PID: 7228)

    • The process drops C-runtime libraries

      • is-ALI05.tmp (PID: 7228)

    • Process drops legitimate windows executable

      • is-ALI05.tmp (PID: 7228)

    • There is functionality for taking screenshot (YARA)

      • eyeBeam_setup.exe (PID: 7208)

    • Creates/Modifies COM task schedule object

      • is-ALI05.tmp (PID: 7228)

  • INFO

    • Create files in a temporary directory

      • eyeBeam_setup.exe (PID: 7208)
      • is-ALI05.tmp (PID: 7228)

    • Checks supported languages

      • is-ALI05.tmp (PID: 7228)
      • eyeBeam_setup.exe (PID: 7208)
      • eyeBeam.exe (PID: 7948)

    • Reads the computer name

      • is-ALI05.tmp (PID: 7228)
      • eyeBeam.exe (PID: 7948)

    • The sample compiled with english language support

      • eyeBeam_setup.exe (PID: 7208)
      • is-ALI05.tmp (PID: 7228)

    • Detects InnoSetup installer (YARA)

      • eyeBeam_setup.exe (PID: 7208)

    • Creates files in the program directory

      • is-ALI05.tmp (PID: 7228)

    • Creates files or folders in the user directory

      • is-ALI05.tmp (PID: 7228)

    • Manual execution by a user

      • eyeBeam.exe (PID: 7948)

    • Creates a software uninstall entry

      • is-ALI05.tmp (PID: 7228)

    • Checks proxy server information

      • eyeBeam.exe (PID: 7948)

    • Reads the machine GUID from the registry

      • eyeBeam.exe (PID: 7948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable PowerBASIC/Win 9.x (51.2)
.exe | Inno Setup installer (37.9)
.exe | Win32 Executable Delphi generic (4.9)
.dll | Win32 Dynamic Link Library (generic) (2.2)
.exe | Win32 Executable (generic) (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 36864
InitializedDataSize: 16896
UninitializedDataSize: -
EntryPoint: 0x97f0
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName:
FileDescription: eyeBeam Setup
FileVersion:
LegalCopyright:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start eyebeam_setup.exe is-ali05.tmp sppextcomobj.exe no specs slui.exe no specs eyebeam.exe no specs eyebeam_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6808"C:\Users\admin\AppData\Local\Temp\eyeBeam_setup.exe" C:\Users\admin\AppData\Local\Temp\eyeBeam_setup.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
eyeBeam Setup
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\appdata\local\temp\eyebeam_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7208"C:\Users\admin\AppData\Local\Temp\eyeBeam_setup.exe" C:\Users\admin\AppData\Local\Temp\eyeBeam_setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
eyeBeam Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\eyebeam_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7228"C:\Users\admin\AppData\Local\Temp\is-IJBVL.tmp\is-ALI05.tmp" /SL4 $60308 "C:\Users\admin\AppData\Local\Temp\eyeBeam_setup.exe" 4190431 52224 C:\Users\admin\AppData\Local\Temp\is-IJBVL.tmp\is-ALI05.tmp
eyeBeam_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.42.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ijbvl.tmp\is-ali05.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7308C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7380"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7948"C:\Program Files (x86)\CounterPath\eyeBeam\eyeBeam.exe" C:\Program Files (x86)\CounterPath\eyeBeam\eyeBeam.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files (x86)\counterpath\eyebeam\eyebeam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
1 259
Read events
867
Write events
392
Delete events
0

Modification events

(PID) Process:(7228) is-ALI05.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:eyeBeam SIP Client
Value:
"C:\Program Files (x86)\CounterPath\eyeBeam\eyeBeam.exe"
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.eba
Operation:writeName:Content Type
Value:
application/eyebeam
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/eyebeam
Operation:writeName:Extension
Value:
.eba
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\eyeBeam.args
Operation:writeName:EditFlags
Value:
D8070100
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sip
Operation:writeName:EditFlags
Value:
02000000
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sip
Operation:writeName:URL Protocol
Value:
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CounterPath\eyeBeam\Plugins\{D68DAE36-61DF-4328-94EB-8241FCF5E228}
Operation:writeName:FriendlyName
Value:
Internet Phone Wizard USB
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CounterPath\eyeBeam\Plugins\{D68DAE36-61DF-4328-94EB-8241FCF5E228}
Operation:writeName:DLLPath
Value:
C:\Program Files (x86)\CounterPath\eyeBeam\SuaIPWUSBDLL.dll
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CounterPath\eyeBeam\Plugins\{D68DAE36-61DF-4328-94EB-8241FCF5E228}
Operation:writeName:Load
Value:
1
(PID) Process:(7228) is-ALI05.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CounterPath\eyeBeam\Plugins\{532EBA6E-D6CC-44c5-8D05-7267372C25F8}
Operation:writeName:FriendlyName
Value:
IPW UP101 USB
Executable files
47
Suspicious files
4
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
7208eyeBeam_setup.exeC:\Users\admin\AppData\Local\Temp\is-IJBVL.tmp\is-ALI05.tmpexecutable
MD5:036EF63E2F9B138A42D6ADB54EC0CD1E
SHA256:71B487F0523F213004766402B22BF86FA0EF9891E940D2A4CB12EBA6627E7CC6
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\is-IURDK.tmpexecutable
MD5:86F1895AE8C5E8B17D99ECE768A70732
SHA256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\msvcr71.dllexecutable
MD5:86F1895AE8C5E8B17D99ECE768A70732
SHA256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
7228is-ALI05.tmpC:\Users\admin\AppData\Local\Temp\is-312K1.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
7228is-ALI05.tmpC:\Users\admin\AppData\Local\Temp\is-312K1.tmp\_isetup\_setup64.tmpexecutable
MD5:4A64B3159D119667764CD40EDC821B5D
SHA256:E8A502E80FBEEA3106E0A101B3EB4E606F485EE1F25DDCAD74507C467E3BE5BF
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\is-HH8G1.tmpexecutable
MD5:561FA2ABB31DFA8FAB762145F81667C2
SHA256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\eyeBeam.exeexecutable
MD5:5116E63FD68420D3FCFB6C16294F15E5
SHA256:1D99939C5CE377566C1325CEBB9A9DE14909F8AB7586C056DDEE4AA4122694C5
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\unins000.exeexecutable
MD5:85332A17A12DA3D0BF3DC08FEA36F803
SHA256:B9FF65C585303D3F96F05FC5F229419B10B34FFE7009D62FD85538A22DCA1100
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\is-0142J.tmpexecutable
MD5:85332A17A12DA3D0BF3DC08FEA36F803
SHA256:B9FF65C585303D3F96F05FC5F229419B10B34FFE7009D62FD85538A22DCA1100
7228is-ALI05.tmpC:\Program Files (x86)\CounterPath\eyeBeam\msvcp71.dllexecutable
MD5:561FA2ABB31DFA8FAB762145F81667C2
SHA256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
18
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8116
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8116
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
8116
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8116
SIHClient.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.183
  • 23.48.23.193
  • 23.48.23.179
  • 23.48.23.176
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.185
  • 23.48.23.137
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.22
  • 20.190.160.64
  • 20.190.160.2
  • 20.190.160.17
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 13.85.23.206
whitelisted
206.23.85.13.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
eyeBeam_setup.exe