File name:

adobe_photoshop_2022_234_mac_os_x.exe

Full analysis: https://app.any.run/tasks/4fc1b9ab-fb15-4c4a-a833-9576f9b99650
Verdict: Malicious activity
Analysis date: March 31, 2023, 21:16:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1A5962C8775965C66035B96AAED2F25F

SHA1:

25CA6501A07DEC9341F45A9A33A00E26AB370C1B

SHA256:

8861E56ACB22A7131E3A61952020E6AA52CC78B1F670953071109F6388539125

SSDEEP:

98304:7v6W8zntQwyUgOlHpKjcCAYSmOppy3Olar:76ftKKlHpUChgr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Reads the Internet Settings

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)

    • Reads the Windows owner or organization settings

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Checks Windows Trust Settings

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

    • Reads security settings of Internet Explorer

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

    • Reads settings of System Certificates

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

    • Adds/modifies Windows certificates

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Searches for installed software

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

    • The process creates files with name similar to system file names

      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Application launched itself

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

  • INFO

    • Create files in a temporary directory

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Reads the machine GUID from the registry

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • saBSI.exe (PID: 2740)

    • Checks supported languages

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • saBSI.exe (PID: 2740)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Reads the computer name

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • saBSI.exe (PID: 2740)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • The process checks LSA protection

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Reads Environment values

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Creates files or folders in the user directory

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Creates files in the program directory

      • saBSI.exe (PID: 2740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

AssemblyVersion: 1.5.1.6476
ProductName: InstallCapital
OriginalFileName: GenericSetup.exe
LegalTrademarks: -
LegalCopyright: Copyright © Adaware 2023
InternalName: IC001.exe
FileDescription: Software Installation
CompanyName: IC001
Comments: -
ProductVersion: 6.95.1.0
FileVersion: 1.5.1.6476
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 6.95.1.0
FileVersionNumber: 1.5.1.6476
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x3e9a0e
UninitializedDataSize: -
InitializedDataSize: 3584
CodeSize: 4094976
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2023:01:19 21:21:38+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
4
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start adobe_photoshop_2022_234_mac_os_x.exe adobe_photoshop_2022_234_mac_os_x.exe sabsi.exe kodi-20.0-nexus_rc2-x64.exe

Process information

PID
CMD
Path
Indicators
Parent process
1872"C:\Users\admin\Downloads\kodi-20.0-Nexus_rc2-x64.exe" C:\Users\admin\Downloads\kodi-20.0-Nexus_rc2-x64.exe
adobe_photoshop_2022_234_mac_os_x.exe
User:
admin
Company:
XBMC Foundation
Integrity Level:
HIGH
Description:
Kodi 19.90.905.0 Setup
Exit code:
2
Version:
19.90.905.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\downloads\kodi-20.0-nexus_rc2-x64.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2368"C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe" C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe
explorer.exe
User:
admin
Company:
IC001
Integrity Level:
MEDIUM
Description:
Software Installation
Exit code:
3762504530
Version:
1.5.1.6476
Modules
Images
c:\users\admin\appdata\local\temp\adobe_photoshop_2022_234_mac_os_x.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
2724"C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe" huac hpp=QzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGFkb2JlX3Bob3Rvc2hvcF8yMDIyXzIzNF9tYWNfb3NfeC5leGU=C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
User:
admin
Company:
IC001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.5.1.6476
Modules
Images
c:\users\admin\appdata\local\temp\adobe_photoshop_2022_234_mac_os_x.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2740"saBSI.exe" /affid 91212 PaidDistribution=true InstallID=76d7c3e0-7997-4aae-9925-f595be7a34e1 subID=JBC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\saBSI.exe
adobe_photoshop_2022_234_mac_os_x.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
4294967295
Version:
4,1,1,663
Modules
Images
c:\users\admin\appdata\local\temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
Total events
34 552
Read events
34 386
Write events
166
Delete events
0

Modification events

(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
12
Suspicious files
6
Text files
38
Unknown types
2

Dropped files

PID
Process
Filename
Type
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\3dba2b032e844ea98475f6258ce8bb25\ServiceHide.dllexecutable
MD5:0D7C4DE3212DAC9329F46BB780EAC784
SHA256:7FF7055E68FB43DDFDA6C7C1E99DFD46B3B76654040DAE920DE0BB79B67ACEB3
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\3dba2b032e844ea98475f6258ce8bb25\ServiceHide.Net.dllexecutable
MD5:0B036CE556E8C7C403948068D810F32A
SHA256:FC9BF8465906F8F9C979D976BD833D403AF1C0D3000AD555420347794E6C4A4D
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\hsrufirj.newcfgxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\user.configxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\Resources\tis\Config.tistext
MD5:BF5328E51E8AB1211C509B5A65AB9972
SHA256:98F22FB45530506548AE320C32EE4939D27017481D2AD0D784AA5516F939545B
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\user.configxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\Resources\images\warning48x48.pngimage
MD5:D3361CF0D689A1B34D84F483D60BA9C9
SHA256:56739925AADA73F9489F9A6B72BFAAA92892B27D20F4D221380BA3EAE17F1442
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\Resources\DownloadFolderPage.htmlhtml
MD5:9DEA08DCA124C9CA58A082E62220ABEE
SHA256:00724E06138C68EB7AB40CDF3275CC7DB45698F10A98AC8C78B5F6582393F64C
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\Downloads\kodi-20.0-Nexus_rc2-x64.exe —
MD5:—
SHA256:—
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\saBSI.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
26
DNS requests
12
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2724
adobe_photoshop_2022_234_mac_os_x.exe
HEAD
200
104.18.212.25:80
http://webcompanion.com/nano_download.php?partner=IT200301
unknown
—
—
malicious
2724
adobe_photoshop_2022_234_mac_os_x.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?133020b60f3eaa92
US
compressed
61.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.18.68.73:443
h2oapi.adaware.com
CLOUDFLARENET
—
whitelisted
2368
adobe_photoshop_2022_234_mac_os_x.exe
104.18.68.73:443
h2oapi.adaware.com
CLOUDFLARENET
—
whitelisted
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.18.67.73:443
h2oapi.adaware.com
CLOUDFLARENET
—
whitelisted
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.17.9.52:443
flow.lavasoft.com
CLOUDFLARENET
—
shared
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.18.212.25:80
webcompanion.com
CLOUDFLARENET
—
whitelisted
2724
adobe_photoshop_2022_234_mac_os_x.exe
185.31.172.243:443
kodi.mirror.liteserver.nl
The Infrastructure Group B.V.
NL
unknown
2724
adobe_photoshop_2022_234_mac_os_x.exe
172.67.189.175:443
walliant.com
CLOUDFLARENET
US
malicious
—
—
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2740
saBSI.exe
35.166.221.252:443
apis.mosaic.analytics.awscommon.mcafee.com
AMAZON-02
US
unknown
2740
saBSI.exe
23.35.236.52:443
sadownload.mcafee.com
AKAMAI-AS
DE
suspicious

DNS requests

Domain
IP
Reputation
h2oapi.adaware.com
  • 104.18.68.73
  • 104.18.67.73
malicious
www.google.com
  • 142.250.185.100
malicious
flow.lavasoft.com
  • 104.17.9.52
  • 104.17.8.52
whitelisted
sos.adaware.com
  • 104.18.67.73
  • 104.18.68.73
whitelisted
webcompanion.com
  • 104.18.212.25
  • 104.18.211.25
malicious
walliant.com
  • 172.67.189.175
  • 104.21.57.77
malicious
sdl.adaware.com
  • 104.18.68.73
  • 104.18.67.73
whitelisted
kodi.mirror.liteserver.nl
  • 185.31.172.243
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted

Threats

PID
Process
Class
Message
2740
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2740
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
6 ETPRO signatures available at the full report
Process
Message
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
Error: File not found - genericsetup.wrappers.sciter:console.tis
adobe_photoshop_2022_234_mac_os_x.exe
at sciter:init-script.tis
adobe_photoshop_2022_234_mac_os_x.exe
at sciter:init-script.tis
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
Error: File not found - genericsetup.wrappers.sciter:console.tis
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
adobe_photoshop_2022_234_mac_os_x.exe