File name:

quicksoftware-dl.exe

Full analysis: https://app.any.run/tasks/3adb0cca-dc10-4faa-8ade-16943080de24
Verdict: Malicious activity
Analysis date: May 23, 2025, 14:53:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

ADD26F07028D142EDB4EC2B018C9D62A

SHA1:

76D903040626DB9DB94552A0FE880E3FA75E863E

SHA256:

B12DE74429CCE391832B921C1E60D797C9E629BE3949A7BF24DBF871AC60B1D7

SSDEEP:

3072:ylZMtTwu1DZN9VVF1VlVrabVFXzaVS4TgIz4O9m5DtXU:y/MtJN9VVF1VlVSTXzaVS4TgIz4iqDm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 6620)
      • LicenseManager.exe (PID: 6728)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • quicksoftware-dl.exe (PID: 4244)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • quicksoftware-dl.exe (PID: 4244)

    • Executable content was dropped or overwritten

      • quicksoftware-dl.exe (PID: 4244)
      • aria2c.exe (PID: 3180)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 6620)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • MBSetup.exe (PID: 3800)

    • Reads security settings of Internet Explorer

      • quicksoftware-dl.exe (PID: 4244)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2332)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)

    • Starts CMD.EXE for commands execution

      • quicksoftware-dl.exe (PID: 4244)

    • There is functionality for taking screenshot (YARA)

      • quicksoftware-dl.exe (PID: 4244)

    • Drops 7-zip archiver for unpacking

      • aria2c.exe (PID: 3180)

    • Reads the Windows owner or organization settings

      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)

    • Reads the BIOS version

      • MBSetup.exe (PID: 3800)

    • The process verifies whether the antivirus software is installed

      • MBSetup.exe (PID: 3800)
      • MBAMInstallerService.exe (PID: 6744)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 6744)

    • Searches for installed software

      • MBSetup.exe (PID: 3800)
      • MBAMInstallerService.exe (PID: 6744)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 3800)

  • INFO

    • Reads the computer name

      • quicksoftware-dl.exe (PID: 4244)
      • aria2c.exe (PID: 3180)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2332)
      • LicenseManager.exe (PID: 6728)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • MBSetup.exe (PID: 3800)
      • MBAMInstallerService.exe (PID: 6744)

    • Checks supported languages

      • quicksoftware-dl.exe (PID: 4244)
      • aria2c.exe (PID: 3180)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2332)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 6620)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • LicenseManager.exe (PID: 6728)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • MBSetup.exe (PID: 3800)
      • MBAMInstallerService.exe (PID: 6744)

    • The sample compiled with english language support

      • quicksoftware-dl.exe (PID: 4244)
      • aria2c.exe (PID: 3180)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • MBSetup.exe (PID: 3800)

    • Create files in a temporary directory

      • quicksoftware-dl.exe (PID: 4244)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 6620)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • MBSetup.exe (PID: 3800)

    • Checks proxy server information

      • quicksoftware-dl.exe (PID: 4244)
      • slui.exe (PID: 1012)
      • LicenseManager.exe (PID: 6728)
      • MBSetup.exe (PID: 3800)

    • Reads the machine GUID from the registry

      • quicksoftware-dl.exe (PID: 4244)
      • aria2c.exe (PID: 3180)
      • MBSetup.exe (PID: 3800)

    • Creates files or folders in the user directory

      • quicksoftware-dl.exe (PID: 4244)
      • LicenseManager.exe (PID: 6728)

    • Reads the software policy settings

      • quicksoftware-dl.exe (PID: 4244)
      • slui.exe (PID: 3192)
      • slui.exe (PID: 1012)
      • MBSetup.exe (PID: 3800)
      • LicenseManager.exe (PID: 6728)
      • MBAMInstallerService.exe (PID: 6744)

    • Creates a new folder

      • cmd.exe (PID: 4724)

    • Manual execution by a user

      • notepad.exe (PID: 5728)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • MBSetup.exe (PID: 1276)
      • MBSetup.exe (PID: 3800)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 5728)

    • Process checks computer location settings

      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2332)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)

    • Detects InnoSetup installer (YARA)

      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2332)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 6620)

    • Creates files in the program directory

      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • MBSetup.exe (PID: 3800)
      • LicenseManager.exe (PID: 6728)
      • MBAMInstallerService.exe (PID: 6744)

    • Compiled with Borland Delphi (YARA)

      • RADStudio_12_1_esd_61_7529b.exe (PID: 1748)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2332)
      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
      • RADStudio_12_1_esd_61_7529b.exe (PID: 6620)

    • The sample compiled with french language support

      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)

    • The sample compiled with german language support

      • RADStudio_12_1_esd_61_7529b.tmp (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
19
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start quicksoftware-dl.exe sppextcomobj.exe no specs slui.exe svchost.exe cmd.exe no specs conhost.exe no specs aria2c.exe conhost.exe no specs notepad.exe no specs rundll32.exe no specs slui.exe radstudio_12_1_esd_61_7529b.exe radstudio_12_1_esd_61_7529b.tmp no specs radstudio_12_1_esd_61_7529b.exe radstudio_12_1_esd_61_7529b.tmp licensemanager.exe mbsetup.exe no specs mbsetup.exe mbaminstallerservice.exe

Process information

PID
CMD
Path
Indicators
Parent process
1012C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1276"C:\Users\admin\Desktop\downloaded-files\MBSetup.exe" C:\Users\admin\Desktop\downloaded-files\MBSetup.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes Setup
Exit code:
3221226540
Version:
5.3.1.129
Modules
Images
c:\users\admin\desktop\downloaded-files\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1748"C:\Users\admin\Desktop\downloaded-files\RADStudio_12_1_esd_61_7529b.exe" C:\Users\admin\Desktop\downloaded-files\RADStudio_12_1_esd_61_7529b.exe
explorer.exe
User:
admin
Company:
Embarcadero Technologies, Inc.
Integrity Level:
MEDIUM
Description:
RAD Studio 12 Setup
Version:
Modules
Images
c:\users\admin\desktop\downloaded-files\radstudio_12_1_esd_61_7529b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2332"C:\Users\admin\AppData\Local\Temp\is-MAUH1.tmp\RADStudio_12_1_esd_61_7529b.tmp" /SL5="$2033E,175867963,868352,C:\Users\admin\Desktop\downloaded-files\RADStudio_12_1_esd_61_7529b.exe" C:\Users\admin\AppData\Local\Temp\is-MAUH1.tmp\RADStudio_12_1_esd_61_7529b.tmp—RADStudio_12_1_esd_61_7529b.exe
User:
admin
Company:
Embarcadero Technologies, Inc.
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-mauh1.tmp\radstudio_12_1_esd_61_7529b.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2800"C:\Users\admin\AppData\Local\Temp\is-CAN9U.tmp\RADStudio_12_1_esd_61_7529b.tmp" /SL5="$3032A,175867963,868352,C:\Users\admin\Desktop\downloaded-files\RADStudio_12_1_esd_61_7529b.exe" /SPAWNWND=$B0292 /NOTIFYWND=$2033E C:\Users\admin\AppData\Local\Temp\is-CAN9U.tmp\RADStudio_12_1_esd_61_7529b.tmp
RADStudio_12_1_esd_61_7529b.exe
User:
admin
Company:
Embarcadero Technologies, Inc.
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-can9u.tmp\radstudio_12_1_esd_61_7529b.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3180"C:\Users\admin\Desktop\aria2c.exe" -d downloaded-files -i aria2script.txtC:\Users\admin\Desktop\aria2c.exe
quicksoftware-dl.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\aria2c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3192"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3800"C:\Users\admin\Desktop\downloaded-files\MBSetup.exe" C:\Users\admin\Desktop\downloaded-files\MBSetup.exe
explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
HIGH
Description:
Malwarebytes Setup
Version:
5.3.1.129
Modules
Images
c:\users\admin\desktop\downloaded-files\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
4024C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
5 562
Read events
5 521
Write events
40
Delete events
1

Modification events

(PID) Process:(4244) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4244) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4244) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2800) RADStudio_12_1_esd_61_7529b.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Embarcadero\BDS\23.0\Globals
Operation:writeName:Personalities
Value:
3
(PID) Process:(3800) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
99d0fe45135d43dcad62ec09df36e1cc
(PID) Process:(3800) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
99d0fe45135d43dcad62ec09df36e1cc
(PID) Process:(3800) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
(PID) Process:(3800) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:UserName
Value:
admin
(PID) Process:(3800) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductCode
Value:
MBAM-C
(PID) Process:(3800) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductBuild
Value:
consumer
Executable files
474
Suspicious files
157
Text files
343
Unknown types
1

Dropped files

PID
Process
Filename
Type
4244quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA0E581ABAB923313BBAD105DEC35C16binary
MD5:C6F648A9CB3955A4D26C558AA3ED7141
SHA256:22E3FD78D34B53178FB658899432EB444B81D87E84CC8781BB73C44A2182225C
4244quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsrC844.tmp\System.dllexecutable
MD5:9B38A1B07A0EBC5C7E59E63346ECC2DB
SHA256:C881253DAFCF1322A771139B1A429EC1E78C507CA81A218A20DC1A4B25ABBFE7
4244quicksoftware-dl.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\aria2c[1].exeexecutable
MD5:6C5EA5A82D756BCA4A9610C8D2260D2F
SHA256:B9CD71B275AF11B63C33457B0F43F2F2675937070C563E195F223EFD7FA4C74B
4244quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsrC844.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
4244quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
4244quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsrC844.tmp\INetC.dllexecutable
MD5:40D7ECA32B2F4D29DB98715DD45BFAC5
SHA256:85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
4244quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsrC844.tmp\nsDialogs.dllexecutable
MD5:8F0E7415F33843431DF308BB8E06AF81
SHA256:BB49F15FA83452370047A7801E39FC7F64E70C7545B8999BB85AA4749EAA048B
4244quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA0E581ABAB923313BBAD105DEC35C16binary
MD5:4025CBE96454716B28B1931B688AC14A
SHA256:0AA1E471178F05591F4175A1776F08AECE6ABC8FD5DAB5C3121340139E3A97EE
4244quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsrC844.tmp\modern-header.bmpimage
MD5:583C38FB0F5AF5FE584D9A9B01D6A3E7
SHA256:4C9E804CE1A391F8E603B7B9C732A6529C1E81BE4D12F125C8562EA9D49095C2
3180aria2c.exeC:\Users\admin\Desktop\downloaded-files\qbittorrent_5.1.0_x64_setup.exe.aria2__tempbinary
MD5:D0C2C66F63A39745F3F0E0EADA9B65EC
SHA256:A87902653E08AAF32FABC4FB8EDF073329337A20C7D89814E7C95F1034842255
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
59
DNS requests
43
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4244
quicksoftware-dl.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
4244
quicksoftware-dl.exe
GET
200
3.167.227.5:80
http://r11.c.lencr.org/84.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
756
lsass.exe
GET
200
3.167.227.5:80
http://r11.c.lencr.org/87.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
18.66.147.67:80
http://e6.c.lencr.org/46.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4244
quicksoftware-dl.exe
139.84.173.225:443
files.webdevtest.ftp.sh
AS-CHOOPA
US
unknown
4244
quicksoftware-dl.exe
23.209.209.135:80
x1.c.lencr.org
PT. Telekomunikasi Selular
ID
whitelisted
4244
quicksoftware-dl.exe
3.167.227.5:80
r11.c.lencr.org
—
US
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
files.webdevtest.ftp.sh
  • 139.84.173.225
unknown
x1.c.lencr.org
  • 23.209.209.135
whitelisted
r11.c.lencr.org
  • 3.167.227.5
  • 3.167.227.115
  • 3.167.227.60
  • 3.167.227.86
whitelisted
login.live.com
  • 20.190.159.64
  • 40.126.31.131
  • 40.126.31.129
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.1
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
7-zip.org
  • 49.12.202.237
unknown
github.com
  • 140.82.121.3
whitelisted
netcologne.dl.sourceforge.net
  • 78.35.24.122
whitelisted
mirror.kumi.systems
  • 110.172.148.96
  • 86.106.182.45
  • 110.172.148.126
  • 110.172.148.100
  • 110.172.148.86
  • 83.138.55.253
  • 83.138.55.214
  • 110.172.148.107
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ftp .sh Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
quicksoftware-dl.exe