File name:

mswlogo_6w-F781.exe

Full analysis: https://app.any.run/tasks/3e1f6884-3eea-4b0a-a0d1-86c91622263c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 22, 2024, 12:23:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
innosetup
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

99A9FBD5FEE72CE51585309390A46717

SHA1:

FF39C56312090A909C2C0C82629C552A3B252A98

SHA256:

833064195B0C96BCE9A8C00DC95DF6BD9FCE1092C1260BA0E877810BFC44B0AA

SSDEEP:

24576:R4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO7:Rqe3f61mZSffPMWrQ0ZkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • INNOSETUP has been detected (SURICATA)

      • file_6w-F781.tmp (PID: 976)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • mswlogo_6w-F781.exe (PID: 2484)
      • mswlogo_6w-F781.exe (PID: 3436)
      • file_6w-F781.exe (PID: 3760)
      • mswlogo_6w-F781.tmp (PID: 1892)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • mswlogo.exe (PID: 1268)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 3808)
      • icarus.exe (PID: 2708)

    • Executable content was dropped or overwritten

      • mswlogo_6w-F781.exe (PID: 2484)
      • mswlogo_6w-F781.exe (PID: 3436)
      • file_6w-F781.exe (PID: 3760)
      • mswlogo_6w-F781.tmp (PID: 1892)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • mswlogo.exe (PID: 1268)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 3808)
      • icarus.exe (PID: 2708)

    • Reads the Windows owner or organization settings

      • mswlogo_6w-F781.tmp (PID: 1892)
      • file_6w-F781.tmp (PID: 976)

    • Reads the Internet Settings

      • mswlogo_6w-F781.tmp (PID: 1892)
      • file_6w-F781.tmp (PID: 976)
      • HelpPane.exe (PID: 3852)

    • Reads settings of System Certificates

      • mswlogo_6w-F781.tmp (PID: 1892)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_online_setup.exe (PID: 3728)

    • Adds/modifies Windows certificates

      • file_6w-F781.tmp (PID: 976)

    • Access to an unwanted program domain was detected

      • file_6w-F781.tmp (PID: 976)

    • Reads security settings of Internet Explorer

      • file_6w-F781.tmp (PID: 976)

    • Potential Corporate Privacy Violation

      • file_6w-F781.tmp (PID: 976)

    • Application launched itself

      • IKernel.exe (PID: 3072)

    • Starts itself from another location

      • icarus.exe (PID: 2292)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 3808)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 3808)

    • Searches for installed software

      • IKernel.exe (PID: 3072)

    • Creates a software uninstall entry

      • IKernel.exe (PID: 3072)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 3808)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 3808)

    • Reads Internet Explorer settings

      • HelpPane.exe (PID: 3852)

    • Reads Microsoft Outlook installation path

      • HelpPane.exe (PID: 3852)

    • The process verifies whether the antivirus software is installed

      • icarus.exe (PID: 2708)
      • icarus.exe (PID: 3808)

    • Creates/Modifies COM task schedule object

      • IKernel.exe (PID: 3072)

  • INFO

    • Reads the computer name

      • mswlogo_6w-F781.tmp (PID: 1488)
      • mswlogo_6w-F781.tmp (PID: 1892)
      • wmpnscfg.exe (PID: 3704)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 2020)
      • IKernel.exe (PID: 3160)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 3808)
      • icarus.exe (PID: 2708)
      • icarus.exe (PID: 2292)
      • logo32.exe (PID: 1384)

    • Create files in a temporary directory

      • mswlogo_6w-F781.exe (PID: 2484)
      • mswlogo_6w-F781.exe (PID: 3436)
      • mswlogo_6w-F781.tmp (PID: 1892)
      • file_6w-F781.tmp (PID: 976)
      • file_6w-F781.exe (PID: 3760)
      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • mswlogo.exe (PID: 1268)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 2708)
      • icarus.exe (PID: 3808)
      • logo32.exe (PID: 1384)

    • Checks supported languages

      • mswlogo_6w-F781.exe (PID: 3436)
      • mswlogo_6w-F781.exe (PID: 2484)
      • mswlogo_6w-F781.tmp (PID: 1488)
      • mswlogo_6w-F781.tmp (PID: 1892)
      • file_6w-F781.exe (PID: 3760)
      • wmpnscfg.exe (PID: 3704)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • mswlogo.exe (PID: 1268)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 2020)
      • icarus.exe (PID: 2292)
      • IKernel.exe (PID: 3160)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 2708)
      • icarus.exe (PID: 3808)
      • logo32.exe (PID: 1384)

    • Reads the software policy settings

      • mswlogo_6w-F781.tmp (PID: 1892)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_online_setup.exe (PID: 3728)

    • Reads the machine GUID from the registry

      • mswlogo_6w-F781.tmp (PID: 1892)
      • avg_antivirus_free_setup.exe (PID: 2704)
      • file_6w-F781.tmp (PID: 976)
      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 3808)
      • icarus.exe (PID: 2708)
      • winhlp32.exe (PID: 3052)
      • HelpPane.exe (PID: 3852)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3704)
      • msedge.exe (PID: 2752)
      • logo32.exe (PID: 1384)

    • Creates files in the program directory

      • avg_antivirus_free_online_setup.exe (PID: 3728)
      • Setup.exe (PID: 2732)
      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 3808)
      • icarus.exe (PID: 2708)

    • Application launched itself

      • msedge.exe (PID: 3532)
      • msedge.exe (PID: 2752)

    • Reads Environment values

      • IKernel.exe (PID: 3072)
      • icarus.exe (PID: 3808)

    • Dropped object may contain TOR URL's

      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 2708)
      • icarus.exe (PID: 3808)

    • Reads CPU info

      • icarus.exe (PID: 2292)
      • icarus.exe (PID: 2708)
      • icarus.exe (PID: 3808)

    • Creates files or folders in the user directory

      • logo32.exe (PID: 1384)

    • Reads security settings of Internet Explorer

      • HelpPane.exe (PID: 3852)

    • Checks proxy server information

      • HelpPane.exe (PID: 3852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:06:03 08:09:11+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 89088
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 4.78.2.0
ProductVersionNumber: 4.78.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Setup
FileVersion: 4.78.2
LegalCopyright:
OriginalFileName:
ProductName: Setup
ProductVersion: 4.78.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
39
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start mswlogo_6w-f781.exe mswlogo_6w-f781.tmp no specs mswlogo_6w-f781.exe mswlogo_6w-f781.tmp file_6w-f781.exe wmpnscfg.exe no specs #INNOSETUP file_6w-f781.tmp avg_antivirus_free_setup.exe avg_antivirus_free_online_setup.exe mswlogo.exe msedge.exe no specs msedge.exe no specs setup.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs ikernel.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs ikernel.exe msedge.exe no specs ikernel.exe no specs msedge.exe no specs msedge.exe no specs icarus.exe icarus.exe icarus.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs logo32.exe no specs winhlp32.exe no specs helppane.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2276 --field-trial-handle=1268,i,784361834978316485,99460732596362121,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
940"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6b33f598,0x6b33f5a8,0x6b33f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
976"C:\Users\admin\AppData\Local\Temp\is-HGIO1.tmp\file_6w-F781.tmp" /SL5="$12014C,1572592,831488,C:\Users\admin\AppData\Local\Temp\is-34PL1.tmp\file_6w-F781.exe" /LANG=en /NA=Rh85hR64C:\Users\admin\AppData\Local\Temp\is-HGIO1.tmp\file_6w-F781.tmp
file_6w-F781.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hgio1.tmp\file_6w-f781.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1268"C:\Users\admin\Downloads\mswlogo.exe" C:\Users\admin\Downloads\mswlogo.exe
file_6w-F781.tmp
User:
admin
Company:
Softronic Inc.
Integrity Level:
HIGH
Exit code:
0
Version:
6.04.009
Modules
Images
c:\users\admin\downloads\mswlogo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1384"C:\Program Files\Softronics\Microsoft Windows Logo\Logo32.exe" C:\Program Files\Softronics\Microsoft Windows Logo\logo32.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\softronics\microsoft windows logo\logo32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1488"C:\Users\admin\AppData\Local\Temp\is-MIHEV.tmp\mswlogo_6w-F781.tmp" /SL5="$6018E,831488,831488,C:\Users\admin\AppData\Local\Temp\mswlogo_6w-F781.exe" C:\Users\admin\AppData\Local\Temp\is-MIHEV.tmp\mswlogo_6w-F781.tmp—mswlogo_6w-F781.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-mihev.tmp\mswlogo_6w-f781.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1876"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1192 --field-trial-handle=1268,i,784361834978316485,99460732596362121,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1892"C:\Users\admin\AppData\Local\Temp\is-JTA74.tmp\mswlogo_6w-F781.tmp" /SL5="$E016C,831488,831488,C:\Users\admin\AppData\Local\Temp\mswlogo_6w-F781.exe" /SPAWNWND=$10016A /NOTIFYWND=$6018E C:\Users\admin\AppData\Local\Temp\is-JTA74.tmp\mswlogo_6w-F781.tmp
mswlogo_6w-F781.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jta74.tmp\mswlogo_6w-f781.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2020"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVERC:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe—IKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1190
Modules
Images
c:\program files\common files\installshield\engine\6\intel 32\ikernel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2060"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1268,i,784361834978316485,99460732596362121,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
49 430
Read events
45 570
Write events
3 840
Delete events
20

Modification events

(PID) Process:(1892) mswlogo_6w-F781.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
6407000034420D1D8EF4DA01
(PID) Process:(1892) mswlogo_6w-F781.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
56A11B62CBA85CBACDA18091F3A135576E453EFDD7B0A6347967D6D59E91557C
(PID) Process:(1892) mswlogo_6w-F781.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(1892) mswlogo_6w-F781.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(976) file_6w-F781.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
D0030000524E07218EF4DA01
(PID) Process:(976) file_6w-F781.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
A1117B54790B20B306C2F8286A28D7EB9193A4439033E8B8A1BB97191DB924A8
(PID) Process:(976) file_6w-F781.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(976) file_6w-F781.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(976) file_6w-F781.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:2A1D6027D94AB10A1C4D915CCD33A0CB3E2D54CB
Value:
(PID) Process:(976) file_6w-F781.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2A1D6027D94AB10A1C4D915CCD33A0CB3E2D54CB
Operation:writeName:Blob
Value:
0400000001000000100000005DB66AC46017246A1A99A84BEE5EB42619000000010000001000000086665B2DECDDA69376F98E02CD5FA29A62000000010000002000000071CCA5391F9E794B04802530B363E121DA8A3043BB26662FEA4DCA7FC951A4BD0B0000000100000018000000470054005300200052006F006F0074002000520034000000140000000100000014000000804CD6EB74FF4936A3D5D8FCB53EC56AF0941D8C1D00000001000000100000006D81CF5A57E7A81939F2FA048E7CB9500300000001000000140000002A1D6027D94AB10A1C4D915CCD33A0CB3E2D54CB0F0000000100000030000000DF03EE17776FAE07203AE956F6094206455C833A06297419E38793A34C4E010E8E0DD06107E0CD574F970FB35FB7C04E09000000010000002A000000302806082B0601050507030206082B0601050507030406082B0601050507030106082B0601050507030820000000010000000E0200003082020A30820191A00302010202106E47A9C88B94B6E8BB3B2AD8A2B2C199300A06082A8648CE3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374205365727669636573204C4C43311430120603550403130B47545320526F6F74205234301E170D3136303632323030303030305A170D3336303632323030303030305A3047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374205365727669636573204C4C43311430120603550403130B47545320526F6F742052343076301006072A8648CE3D020106052B8104002203620004F37473A7688B60AE43B835C581307B4B499DFBC161CEE6DE46BD6BD5611835AE40DD73F78991305AEB3CEE857CA240763BA9C6B847D82AE792916A73E9B172399F299FA298D35F5E5886650FA1846506D1DC8BC9C773C88C6A2FE5C4ABD11D8AA3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E04160414804CD6EB74FF4936A3D5D8FCB53EC56AF0941D8C300A06082A8648CE3D040303036700306402306A50527408C470DC9E507421E88D7A21C34F966E15D12235612DFA0837EE196DADDBB2CC7D0734F560192CB534D96F2002300371B1BAA3600B86ED9A086A95689FE2B3E193647C5E93A6DF792D8D85E394CF235D71CCF2B04DD6FE99C894A975A2E3
Executable files
487
Suspicious files
856
Text files
627
Unknown types
26

Dropped files

PID
Process
Filename
Type
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\is-88U7N.tmpimage
MD5:AEE8E80B35DCB3CF2A5733BA99231560
SHA256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\is-DLSCA.tmpcompressed
MD5:56B0D3E1B154AE65682C167D25EC94A6
SHA256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\AVG_AV.pngimage
MD5:AEE8E80B35DCB3CF2A5733BA99231560
SHA256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
1892mswlogo_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-34PL1.tmp\is-LQMQT.tmpexecutable
MD5:DF85661C015A03E71A9313B2F72D1EFA
SHA256:D2F397B0F81E098F0DB0A293F47032D354EE9CEAFCECD5AC474E5DDA1B05C14E
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\is-TGPBR.tmpimage
MD5:677C9F8958C714C6963EBF55FB51CDBA
SHA256:3C72D2EAFC177B89EEAA0D8715D966BE5C9755B8A8A8449BF9F5629F8CE427B1
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\Helper.dllexecutable
MD5:4EB0347E66FA465F602E52C03E5C0B4B
SHA256:C73E53CBB7B98FEAFE27CC7DE8FDAD51DF438E2235E91891461C5123888F73CC
3760file_6w-F781.exeC:\Users\admin\AppData\Local\Temp\is-HGIO1.tmp\file_6w-F781.tmpexecutable
MD5:8CF2935FF1AB8729D059BDA47761E0A7
SHA256:21D9CA1FC088AFFAD73821C5983847779B5E97C4926068746715DE256CF360E9
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\finish.pngimage
MD5:C22FCE016D422F84213A414D01CEE6D7
SHA256:26AAE139966F128AAC4185263E04DD8C7E65F42B3FDC81397EC80CC350E8BB12
1892mswlogo_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-34PL1.tmp\file_6w-F781.exeexecutable
MD5:DF85661C015A03E71A9313B2F72D1EFA
SHA256:D2F397B0F81E098F0DB0A293F47032D354EE9CEAFCECD5AC474E5DDA1B05C14E
976file_6w-F781.tmpC:\Users\admin\AppData\Local\Temp\is-LV9DN.tmp\mainlogo.pngimage
MD5:677C9F8958C714C6963EBF55FB51CDBA
SHA256:3C72D2EAFC177B89EEAA0D8715D966BE5C9755B8A8A8449BF9F5629F8CE427B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
77
DNS requests
90
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
23.50.131.200:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
976
file_6w-F781.tmp
GET
—
95.168.168.24:80
http://dl.jalecdn.com/US/mswlogo.exe
unknown
—
—
malicious
2704
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
unknown
2704
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
unknown
1060
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e1c7fb6f69bbdcfa
unknown
—
—
whitelisted
2704
avg_antivirus_free_setup.exe
POST
200
142.250.185.174:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
2704
avg_antivirus_free_setup.exe
POST
200
142.250.185.174:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1892
mswlogo_6w-F781.tmp
52.222.232.42:443
d3fzprifddppqn.cloudfront.net
AMAZON-02
US
unknown
976
file_6w-F781.tmp
3.160.156.117:443
de1k8xcm09f8m.cloudfront.net
—
US
unknown
976
file_6w-F781.tmp
104.27.203.89:443
cdn.fileplanet.com
CLOUDFLARENET
US
unknown
1372
svchost.exe
23.50.131.200:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
d3fzprifddppqn.cloudfront.net
  • 52.222.232.42
  • 52.222.232.199
  • 52.222.232.109
  • 52.222.232.61
whitelisted
de1k8xcm09f8m.cloudfront.net
  • 3.160.156.117
  • 3.160.156.96
  • 3.160.156.109
  • 3.160.156.104
whitelisted
cdn.fileplanet.com
  • 104.27.203.89
  • 104.27.204.89
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.200
  • 23.50.131.216
  • 199.232.214.172
  • 199.232.210.172
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
dl.jalecdn.com
  • 95.168.168.24
unknown
honzik.avcdn.net
  • 23.32.101.67
  • 2a02:26f0:3500:f84::240d
  • 2a02:26f0:3500:f92::240d
whitelisted

Threats

PID
Process
Class
Message
976
file_6w-F781.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
976
file_6w-F781.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
3152
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
3152
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
3152
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3152
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mswlogo_6w-F781.exe