File name:

Pluginpack.exe

Full analysis: https://app.any.run/tasks/108c9bd4-a33a-4f6f-881d-939ee1bb5b09
Verdict: Malicious activity
Analysis date: September 06, 2024, 05:23:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

001AB715045DF3160396E472BEA0A14C

SHA1:

B215B49CD73D160CD7B5819198633F30D58F6907

SHA256:

AC698137BD27BECCD1F5C81B9E4E6D9A40372DEEB4680B36BE9F2D31D7EB5C7F

SSDEEP:

98304:L+fgwxAvQlT5Ne4r5KgBsVli+mXzeV6bZ4YQ9fC4QEjJjgNIixn1ZzQ3v9unx3Pj:e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7044)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • dllCrt32.exe (PID: 6148)

    • Starts CMD.EXE for commands execution

      • dllCrt32.exe (PID: 6148)
      • cmd.exe (PID: 7044)

    • Drops 7-zip archiver for unpacking

      • Pluginpack.exe (PID: 6460)

    • Executable content was dropped or overwritten

      • Pluginpack.exe (PID: 6460)

    • Reads security settings of Internet Explorer

      • Pluginpack.exe (PID: 6460)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7044)

    • Lists all scheduled tasks

      • schtasks.exe (PID: 6352)

    • Application launched itself

      • cmd.exe (PID: 7044)

    • Creates a software uninstall entry

      • Pluginpack.exe (PID: 6460)

  • INFO

    • Reads the computer name

      • Pluginpack.exe (PID: 6460)

    • Checks supported languages

      • Pluginpack.exe (PID: 6460)
      • dllCrt32.exe (PID: 6148)

    • Create files in a temporary directory

      • Pluginpack.exe (PID: 6460)

    • Creates files or folders in the user directory

      • Pluginpack.exe (PID: 6460)

    • Dropped object may contain TOR URL's

      • Pluginpack.exe (PID: 6460)

    • The process uses the downloaded file

      • Pluginpack.exe (PID: 6460)

    • Process checks computer location settings

      • Pluginpack.exe (PID: 6460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (31.9)
.scr | Windows screen saver (29.4)
.dll | Win32 Dynamic Link Library (generic) (14.8)
.exe | Win32 Executable (generic) (10.1)
.exe | Win16/32 Executable Delphi generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 148992
InitializedDataSize: 30720
UninitializedDataSize: -
EntryPoint: 0x25468
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.65.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: Thelanb Co.
FileDescription: PluginPack 4.65.0.0 Installation
FileVersion: 4.65.0.0
LegalCopyright: Thelanb Co.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
9
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start pluginpack.exe dllcrt32.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs findstr.exe no specs schtasks.exe no specs schtasks.exe no specs pluginpack.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2384C:\WINDOWS\system32\cmd.exe /S /D /c" echo C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files\PowerShell\7\;C:\Users\admin\AppData\Local\Microsoft\WindowsApps "C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2628findstr WindowsApps C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4688"C:\Users\admin\AppData\Local\Temp\Pluginpack.exe" C:\Users\admin\AppData\Local\Temp\Pluginpack.exe—explorer.exe
User:
admin
Company:
Thelanb Co.
Integrity Level:
MEDIUM
Description:
PluginPack 4.65.0.0 Installation
Exit code:
3221226540
Version:
4.65.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pluginpack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6148"C:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt32.exe" C:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt32.exe—Pluginpack.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windowsapps\dllcrt32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6160schtasks /create /xml "C:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt.xml" /tn "Check dllHourly32" C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6352schtasks /query /tn "Check dllHourly32" C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6460"C:\Users\admin\AppData\Local\Temp\Pluginpack.exe" C:\Users\admin\AppData\Local\Temp\Pluginpack.exe
explorer.exe
User:
admin
Company:
Thelanb Co.
Integrity Level:
HIGH
Description:
PluginPack 4.65.0.0 Installation
Version:
4.65.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pluginpack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7044C:\WINDOWS\system32\cmd.exe /c dllCrt.batC:\Windows\SysWOW64\cmd.exe—dllCrt32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
406
Read events
390
Write events
16
Delete events
0

Modification events

(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:DisplayName
Value:
PluginPack 4.65.0.0
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:DisplayVersion
Value:
4.65.0.0
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:VersionMajor
Value:
4
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:VersionMinor
Value:
65
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:Publisher
Value:
Thelanb Co.
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Temp\Uninstall.exe
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:UninstallString
Value:
C:\Users\admin\AppData\Local\Temp\Uninstall.exe
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:URLInfoAbout
Value:
https://thelanb.com
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:HelpLink
Value:
support@thelanb.com
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Temp\
Executable files
4
Suspicious files
2
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dll_srv.txttext
MD5:38BAFDA16A0BE406E0A184F0E632DC78
SHA256:3E6C05FFEA6E6C861380FAF6C72D038BBB5E39B9F55C64E57892AC7F19B49B05
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\4.tmpimage
MD5:0D8DBE5CD39F3369265D93195E5C6449
SHA256:FD17CA05FA0587FBF2D1AB722EBBF4A4B254F2EC0048E9CDAE20655F7DE06A39
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllBus.battext
MD5:8E0C87F4AC098DC5F43E7367D1AD65C0
SHA256:C430CCDC07C9B517FAA4C9241F86466B9FF8AC55A7C49A491613D53E2EC3D00D
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt.xmlxml
MD5:151A761FB5BF225EB2B382240C415A84
SHA256:CDC1F2430681E9278B3F738ED74954C4366B8EFF52C937F185D760C1BBBA2F1D
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmpcompressed
MD5:07004A35B753BFE1DB65A81B3951AC8E
SHA256:11BCAB6470B49ADFFDC127A15CDF7C3BC4EE1382B97673C82FEEE8A50715C69A
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt.battext
MD5:069B9F2F6D181121354FACD2E9680474
SHA256:A89953915EABE5C4897E414E73F28C300472298A6A8C055FCC956C61C875FD96
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt32.exeexecutable
MD5:88EA05AE03C3106678FF4355D1DCBBB4
SHA256:FDC84CB0845F87A39B29027D6433F4A1BBD8C5B808280235CF867A6B0B7A91EB
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\7z.exeexecutable
MD5:43141E85E7C36E31B52B22AB94D5E574
SHA256:EA308C76A2F927B160A143D94072B0DCE232E04B751F0C6432A94E05164E716D
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dll_updt.txttext
MD5:30565A8911A6BB487E3745C0EA3C8224
SHA256:8AED642BF5118B9D3C859BD4BE35ECAC75B6E873CCE34E7B6F554B06F75550D7
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\5.tmpimage
MD5:AB2021E67E0E08657288D880ABFBAA72
SHA256:331D997E586CBA40D4DA0587887FC4CAA4CC44E53421737DAFA67E67445E6753
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2112
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2112
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2400
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6652
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1436
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Pluginpack.exe