File name:

971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f

Full analysis: https://app.any.run/tasks/68c573ba-bea2-4694-ae0f-05e79a93d7e9
Verdict: Malicious activity
Analysis date: May 15, 2025, 11:25:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

1FCB02D41942072784B783BBBA7CE04A

SHA1:

19D455644F52F420BF86992C52DB41BC4F7E417D

SHA256:

971D4A9B031A721FE60AC30C7C8466F0A13AE6039A1F73886C0BC37D13E3128F

SSDEEP:

98304:lxL5qjsE50+h+J2tFaAQQOX4iwmHDV/8nqA3zWh/s2OHdRyfe0cC9d+APP18YYB9:w1hn9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)
      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 7148)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)
      • iLividSetupV1.exe (PID: 5280)

    • Drops 7-zip archiver for unpacking

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)

    • Reads security settings of Internet Explorer

      • iLividSetupV1.exe (PID: 5280)

  • INFO

    • The sample compiled with english language support

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)

    • Checks supported languages

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)
      • iLividSetupV1.exe (PID: 5280)

    • Reads the computer name

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)
      • iLividSetupV1.exe (PID: 5280)

    • Create files in a temporary directory

      • 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe (PID: 2692)
      • iLividSetupV1.exe (PID: 5280)

    • Checks proxy server information

      • iLividSetupV1.exe (PID: 5280)

    • Reads the software policy settings

      • slui.exe (PID: 4560)

    • Compiled with Borland Delphi (YARA)

      • iLividSetupV1.exe (PID: 5280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:04:15 20:43:49+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 98816
InitializedDataSize: 121856
UninitializedDataSize: -
EntryPoint: 0x12a70
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.92.871.32734
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: This installation was built with InstallAware: http://www.installaware.com
CompanyName: Bandoo Media Inc.
FileDescription: iLivid Installation
FileVersion: 1.92.0.117387
LegalCopyright: All rights reserved
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe ilividsetupv1.exe sppextcomobj.exe no specs slui.exe slui.exe no specs 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2692"C:\Users\admin\AppData\Local\Temp\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe" C:\Users\admin\AppData\Local\Temp\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe
explorer.exe
User:
admin
Company:
Bandoo Media Inc.
Integrity Level:
HIGH
Description:
iLivid Installation
Version:
1.92.0.117387
Modules
Images
c:\users\admin\appdata\local\temp\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4560"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5008C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5280.\iLividSetupV1.exe /m="C:\Users\admin\AppData\Local\Temp\971D4A~1.EXE" /k=""C:\Users\admin\AppData\Local\Temp\miaB817.tmp\iLividSetupV1.exe
971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe
User:
admin
Company:
Bandoo Media Inc.
Integrity Level:
HIGH
Description:
iLivid Installation
Version:
1.92.0.117387
Modules
Images
c:\users\admin\appdata\local\temp\miab817.tmp\ilividsetupv1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6512C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7148"C:\Users\admin\AppData\Local\Temp\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe" C:\Users\admin\AppData\Local\Temp\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe—explorer.exe
User:
admin
Company:
Bandoo Media Inc.
Integrity Level:
MEDIUM
Description:
iLivid Installation
Exit code:
3221226540
Version:
1.92.0.117387
Modules
Images
c:\users\admin\appdata\local\temp\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
1 154
Read events
1 132
Write events
20
Delete events
2

Modification events

(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe
Operation:writeName:IsHostApp
Value:
(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:8D15E1B2
Value:
(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:8D15E1B2
Value:
(PID) Process:(2692) 971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exe
Operation:writeName:IsHostApp
Value:
(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ReceiveTimeout
Value:
10000
(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5280) iLividSetupV1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
8
Suspicious files
11
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
2692971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exeC:\Users\admin\AppData\Local\Temp\miaB817.tmp\data\OFFLINE\mIDEFunc.dll\mEXEFunc.dllexecutable
MD5:F184BE47FF281B17D8AC5C702F4CA896
SHA256:D2446D97172A0199DDC532D901B1A814B2B55F3B243998D2725754610B975312
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\lang.loctext
MD5:92E9EF9EEE03426DBDAB6CC57D8EA5FD
SHA256:144E84DE063A4114B350E41B09B96A7E25967E7A7AEC6B2B38EE3C12F7E3A1BF
2692971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exeC:\Users\admin\AppData\Local\Temp\miaB817.tmp\iLividSetupV1.rescompressed
MD5:6896755F9F046FEE43E6DEC89E721B78
SHA256:AC5D6615A1C2C37566A80125DB585CD190636EBBE2FCFAC2A421385185E8F194
2692971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f.exeC:\Users\admin\AppData\Local\Temp\miaB817.tmp\data\OFFLINE\mDown.dll\mDownExec.dllexecutable
MD5:B7F0D95E4E97D518496FD9D90A4E0786
SHA256:51512BA85758FB12CFD9A1850C9BEB9151FD41C5997F07F74D174CC4C787C876
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\mia1\finish.dfmbinary
MD5:8A6E6EC127DE1A4DC4CAFC8C0F7F9895
SHA256:246D3FFF7397949F274188AFEF69B3D911B565CE114462872E0EAA6BF2080FDE
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\mia1\progress.dfmbinary
MD5:B8AE31A7FD1A1660B4EA1E46BD862422
SHA256:A23B2AD6564C60D1C23C5AB4F919D5D7DFF504ACF0CB8A87487D9F6BBB563916
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\mia1\destination.dfmbinary
MD5:5CB646FC6179D59EBDEB7F67912664C8
SHA256:41BB1982457965C9C1CC60C5B7696AE4DEEC36C0117C89C18BC2A50B053A34D9
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\mia.tmptext
MD5:DF2B9BD3FCE2B49E1560A55E5EE31669
SHA256:60D3EBB61FC3BBFF74E1F50ED121FDBE90695FA60115A2AA104351A66215D99F
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\mia1\icon.icoimage
MD5:65875FBD5732E431DA3068B36251952A
SHA256:5D12554D6F8321DFCB44038198CC1568089346D2F4C2F0D9512BF6DE5FB8D6FD
5280iLividSetupV1.exeC:\Users\admin\AppData\Local\Temp\mia1\finish.dfm.miaftext
MD5:58F9CEE2A23ACD0F2A6DF937353CD012
SHA256:8C39111E0E3DE96E65D1A610863DE42813A55AB21EBE9A780DFC4960D07CF068
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6652
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6652
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
download.cdn.ilivid.com
  • —
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.69
  • 20.190.159.130
  • 40.126.31.129
  • 20.190.159.75
  • 40.126.31.131
  • 20.190.159.129
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
971d4a9b031a721fe60ac30c7c8466f0a13ae6039a1f73886c0bc37d13e3128f