File name:

quicksoftware-dl.exe

Full analysis: https://app.any.run/tasks/de30250f-b0f7-414f-98b2-74216d8a97dc
Verdict: Malicious activity
Analysis date: May 24, 2025, 12:23:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

ADD26F07028D142EDB4EC2B018C9D62A

SHA1:

76D903040626DB9DB94552A0FE880E3FA75E863E

SHA256:

B12DE74429CCE391832B921C1E60D797C9E629BE3949A7BF24DBF871AC60B1D7

SSDEEP:

3072:ylZMtTwu1DZN9VVF1VlVrabVFXzaVS4TgIz4O9m5DtXU:y/MtJN9VVF1VlVSTXzaVS4TgIz4iqDm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • setup.exe (PID: 2904)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • setup.exe (PID: 2552)
      • setup.exe (PID: 2904)
      • Everything-1.4.1.1026.x64-Setup.exe (PID: 3868)
      • nsis-3.11-setup.exe (PID: 3968)
      • NSIS.exe (PID: 7152)

    • Starts CMD.EXE for commands execution

      • quicksoftware-dl.exe (PID: 4628)
      • PowerToysSetup-0.91.1-x64.exe (PID: 1228)

    • There is functionality for taking screenshot (YARA)

      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • setup.exe (PID: 2552)
      • Everything-1.4.1.1026.x64-Setup.exe (PID: 3868)
      • Everything.exe (PID: 4700)
      • setup.exe (PID: 2904)

    • Reads security settings of Internet Explorer

      • quicksoftware-dl.exe (PID: 4628)
      • setup.exe (PID: 2552)
      • setup.exe (PID: 2904)

    • The process creates files with name similar to system file names

      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • setup.exe (PID: 2904)
      • setup.exe (PID: 2552)
      • MBAMInstallerService.exe (PID: 3036)

    • Executable content was dropped or overwritten

      • quicksoftware-dl.exe (PID: 4628)
      • aria2c.exe (PID: 1696)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • floorp-win64.installer.exe (PID: 6344)
      • MBAMInstallerService.exe (PID: 3036)
      • setup.exe (PID: 2904)
      • setup.exe (PID: 2552)
      • Everything-1.4.1.1026.x64-Setup.exe (PID: 3868)
      • everything.exe (PID: 5508)
      • 7z2409-x64.exe (PID: 5172)
      • nsis-3.11-setup.exe (PID: 3968)
      • NSIS.exe (PID: 7152)
      • PowerToysSetup-0.91.1-x64.exe (PID: 4180)
      • PowerToysSetup-0.91.1-x64.exe (PID: 5176)
      • VirtualBox-7.1.8-168469-Win.exe (PID: 208)
      • PowerToysSetup-0.91.1-x64.exe (PID: 1228)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3272)
      • drvinst.exe (PID: 7020)
      • MBAMService.exe (PID: 6816)
      • MBAMService.exe (PID: 6708)
      • MBVpnTunnelService.exe (PID: 6880)
      • drvinst.exe (PID: 8396)
      • drvinst.exe (PID: 7628)
      • drvinst.exe (PID: 7344)
      • drvinst.exe (PID: 8336)
      • drvinst.exe (PID: 7372)
      • drvinst.exe (PID: 8608)
      • drvinst.exe (PID: 7428)

    • Drops 7-zip archiver for unpacking

      • aria2c.exe (PID: 1696)
      • MBAMInstallerService.exe (PID: 3036)
      • 7z2409-x64.exe (PID: 5172)

    • Creates a software uninstall entry

      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 5736)

    • Searches for installed software

      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • MBAMInstallerService.exe (PID: 3036)

    • Reads the BIOS version

      • MBSetup.exe (PID: 4448)

    • The process verifies whether the antivirus software is installed

      • MBSetup.exe (PID: 4448)
      • MBAMInstallerService.exe (PID: 3036)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 4448)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 3036)
      • Everything.exe (PID: 4700)
      • VSSVC.exe (PID: 1812)
      • MBAMService.exe (PID: 6708)

    • Process drops legitimate windows executable

      • floorp-win64.installer.exe (PID: 6344)
      • MBAMInstallerService.exe (PID: 3036)
      • setup.exe (PID: 2904)
      • PowerToysSetup-0.91.1-x64.exe (PID: 4180)
      • PowerToysSetup-0.91.1-x64.exe (PID: 1228)
      • PowerToysSetup-0.91.1-x64.exe (PID: 5176)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3272)
      • MicrosoftEdgeUpdate.exe (PID: 7100)
      • MBAMService.exe (PID: 6708)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMInstallerService.exe (PID: 3036)
      • drvinst.exe (PID: 7020)
      • MBAMService.exe (PID: 6816)
      • MBVpnTunnelService.exe (PID: 6880)
      • MBAMService.exe (PID: 6708)
      • drvinst.exe (PID: 7628)
      • drvinst.exe (PID: 8396)
      • msiexec.exe (PID: 6372)
      • drvinst.exe (PID: 7344)
      • drvinst.exe (PID: 8336)
      • msiexec.exe (PID: 684)
      • drvinst.exe (PID: 7372)
      • drvinst.exe (PID: 7428)
      • drvinst.exe (PID: 8608)

    • The process drops C-runtime libraries

      • floorp-win64.installer.exe (PID: 6344)
      • setup.exe (PID: 2904)
      • MBAMInstallerService.exe (PID: 3036)
      • MBAMService.exe (PID: 6708)

    • Application launched itself

      • setup.exe (PID: 2552)
      • everything.exe (PID: 4376)
      • floorp.exe (PID: 6148)
      • floorp.exe (PID: 3760)
      • floorp.exe (PID: 2892)
      • floorp.exe (PID: 512)
      • msiexec.exe (PID: 684)

    • Starts a Microsoft application from unusual location

      • PowerToysSetup-0.91.1-x64.exe (PID: 5176)
      • PowerToysSetup-0.91.1-x64.exe (PID: 1228)
      • PowerToysSetup-0.91.1-x64.exe (PID: 4180)
      • MicrosoftEdgeUpdate.exe (PID: 7100)

    • Starts itself from another location

      • everything.exe (PID: 5508)
      • PowerToysSetup-0.91.1-x64.exe (PID: 4180)

    • Executing commands from ".cmd" file

      • PowerToysSetup-0.91.1-x64.exe (PID: 1228)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6592)

  • INFO

    • Creates files or folders in the user directory

      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)

    • The sample compiled with english language support

      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • aria2c.exe (PID: 1696)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • floorp-win64.installer.exe (PID: 6344)
      • MBAMInstallerService.exe (PID: 3036)
      • setup.exe (PID: 2904)
      • Everything-1.4.1.1026.x64-Setup.exe (PID: 3868)
      • 7z2409-x64.exe (PID: 5172)
      • hh.exe (PID: 1568)
      • everything.exe (PID: 5508)
      • PowerToysSetup-0.91.1-x64.exe (PID: 4180)
      • PowerToysSetup-0.91.1-x64.exe (PID: 5176)
      • PowerToysSetup-0.91.1-x64.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 7100)
      • msiexec.exe (PID: 684)
      • VirtualBox-7.1.8-168469-Win.exe (PID: 208)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3272)
      • drvinst.exe (PID: 7020)
      • MBAMService.exe (PID: 6816)
      • MBAMService.exe (PID: 6708)
      • MBVpnTunnelService.exe (PID: 6880)
      • drvinst.exe (PID: 8396)
      • drvinst.exe (PID: 7344)
      • msiexec.exe (PID: 6372)
      • drvinst.exe (PID: 7628)
      • drvinst.exe (PID: 8608)
      • drvinst.exe (PID: 7372)
      • drvinst.exe (PID: 7428)
      • drvinst.exe (PID: 8336)

    • Reads the computer name

      • quicksoftware-dl.exe (PID: 4628)
      • aria2c.exe (PID: 1696)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • floorp-win64.installer.exe (PID: 6344)
      • MBAMInstallerService.exe (PID: 3036)
      • setup.exe (PID: 2552)
      • setup.exe (PID: 2904)

    • Reads the software policy settings

      • quicksoftware-dl.exe (PID: 4628)
      • slui.exe (PID: 5116)
      • MBSetup.exe (PID: 4448)
      • MBAMInstallerService.exe (PID: 3036)

    • Checks supported languages

      • aria2c.exe (PID: 1696)
      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • floorp-win64.installer.exe (PID: 6344)
      • MBAMInstallerService.exe (PID: 3036)
      • setup.exe (PID: 2904)
      • setup.exe (PID: 2552)

    • Creates a new folder

      • cmd.exe (PID: 4844)

    • Reads the machine GUID from the registry

      • quicksoftware-dl.exe (PID: 4628)
      • aria2c.exe (PID: 1696)
      • MBSetup.exe (PID: 4448)

    • Checks proxy server information

      • quicksoftware-dl.exe (PID: 4628)
      • MBSetup.exe (PID: 4448)

    • Create files in a temporary directory

      • quicksoftware-dl.exe (PID: 4628)
      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • floorp-win64.installer.exe (PID: 6344)
      • setup.exe (PID: 2904)
      • setup.exe (PID: 2552)

    • Manual execution by a user

      • nsis-3.11-setup.exe (PID: 1300)
      • nsis-3.11-setup.exe (PID: 5972)
      • npp.8.8.1.Installer.x64.exe (PID: 5504)
      • MBSetup.exe (PID: 4376)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • floorp-win64.installer.exe (PID: 6344)
      • Everything-1.4.1.1026.x64-Setup.exe (PID: 3868)
      • 7z2409-x64.exe (PID: 1560)
      • 7z2409-x64.exe (PID: 5172)
      • nsis-3.11-setup.exe (PID: 3012)
      • nsis-3.11-setup.exe (PID: 3968)
      • msiexec.exe (PID: 6708)
      • PowerToysSetup-0.91.1-x64.exe (PID: 5176)
      • VirtualBox-7.1.8-168469-Win.exe (PID: 2560)
      • VirtualBox-7.1.8-168469-Win.exe (PID: 208)

    • Creates files in the program directory

      • nsis-3.11-setup.exe (PID: 1300)
      • npp.8.8.1.Installer.x64.exe (PID: 2692)
      • MBSetup.exe (PID: 4448)
      • MBAMInstallerService.exe (PID: 3036)
      • setup.exe (PID: 2904)

    • Process checks computer location settings

      • setup.exe (PID: 2552)

    • Process checks whether UAC notifications are on

      • setup.exe (PID: 2552)

    • The sample compiled with spanish language support

      • MBAMInstallerService.exe (PID: 3036)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6708)
      • msiexec.exe (PID: 684)
      • msiexec.exe (PID: 6372)

    • Manages system restore points

      • SrTasks.exe (PID: 540)
      • SrTasks.exe (PID: 840)
      • SrTasks.exe (PID: 8160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
282
Monitored processes
130
Malicious processes
14
Suspicious processes
6

Behavior graph

Click at the process to see the details
start quicksoftware-dl.exe sppextcomobj.exe no specs slui.exe svchost.exe cmd.exe no specs conhost.exe no specs aria2c.exe conhost.exe no specs slui.exe rundll32.exe no specs nsis-3.11-setup.exe no specs nsis-3.11-setup.exe npp.8.8.1.installer.x64.exe no specs npp.8.8.1.installer.x64.exe regsvr32.exe no specs regsvr32.exe no specs mbsetup.exe no specs mbsetup.exe mbaminstallerservice.exe floorp-win64.installer.exe setup.exe setup.exe regsvr32.exe no specs default-browser-agent.exe no specs floorp.exe no specs floorp.exe no specs everything-1.4.1.1026.x64-setup.exe floorp.exe no specs floorp.exe no specs everything.exe no specs everything.exe everything.exe no specs everything.exe no specs everything.exe no specs 7z2409-x64.exe no specs 7z2409-x64.exe nsis-3.11-setup.exe no specs nsis-3.11-setup.exe nsis.exe hh.exe no specs powertoyssetup-0.91.1-x64.exe powertoyssetup-0.91.1-x64.exe powertoyssetup-0.91.1-x64.exe SPPSurrogate no specs vssvc.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs srtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe srtasks.exe no specs conhost.exe no specs virtualbox-7.1.8-168469-win.exe no specs virtualbox-7.1.8-168469-win.exe everything.exe no specs msiexec.exe no specs mbvpntunnelservice.exe conhost.exe no specs drvinst.exe mbamservice.exe mbamservice.exe floorp.exe no specs floorp.exe floorp.exe no specs floorp.exe no specs floorp.exe no specs floorp.exe no specs floorp.exe no specs floorp.exe no specs srtasks.exe no specs conhost.exe no specs floorp.exe no specs floorp.exe no specs floorp.exe no specs floorp.exe no specs malwarebytes.exe floorp.exe no specs floorp.exe no specs floorp.exe no specs floorp.exe no specs msiexec.exe no specs msiexec.exe no specs ig.exe no specs floorp.exe no specs help.exe no specs help.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs floorp.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs mbamwsc.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs floorp.exe no specs msiexec.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe msiexec.exe no specs drvinst.exe drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Users\admin\Desktop\downloaded-files\VirtualBox-7.1.8-168469-Win.exe" C:\Users\admin\Desktop\downloaded-files\VirtualBox-7.1.8-168469-Win.exe
explorer.exe
User:
admin
Company:
Oracle and/or its affiliates
Integrity Level:
HIGH
Description:
VirtualBox Installer
Version:
7.1.8.168469
512"C:\Program Files\Ablaze Floorp\floorp.exe" -first-startupC:\Program Files\Ablaze Floorp\floorp.exe
floorp.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Floorp
Exit code:
0
Version:
128.11.0
540C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
2147942487
Version:
10.0.19041.1 (WinBuild.160101.0800)
684C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
776C:\Windows\syswow64\MsiExec.exe -Embedding F1BE0055C721514935BA20BC896F5F98 M Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
840C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:12C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—aria2c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1228"C:\Program Files\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033C:\Program Files\Everything\Everything.exe—Everything-1.4.1.1026.x64-Setup.exe
User:
admin
Company:
voidtools
Integrity Level:
MEDIUM
Description:
Everything
Exit code:
0
Version:
1.4.1.1026
1228"C:\Users\admin\AppData\Local\Temp\{29E6096F-97DB-4959-BD69-E279302ACA62}\.be\PowerToysSetup-0.91.1-x64.exe" -q -burn.elevated BurnPipe.{542B1980-416A-499E-943F-48FEA839D396} {60148399-FB13-41A0-B376-2ACC09AF8AA0} 4180C:\Users\admin\AppData\Local\Temp\{29E6096F-97DB-4959-BD69-E279302ACA62}\.be\PowerToysSetup-0.91.1-x64.exe
PowerToysSetup-0.91.1-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
PowerToys (Preview) x64
Exit code:
1800
Version:
0.91.1
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
1 829
Suspicious files
881
Text files
933
Unknown types
0

Dropped files

PID
Process
Filename
Type
4628quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_786EA6C36BF7ABFF201B638497282D19binary
MD5:2C4D15B99429A495319CDEF89BB38A1D
SHA256:FD2ED1BD4303C246D3514830353F38D24E450F865CB0C41647F7BE80702CEB1E
4628quicksoftware-dl.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\aria2c[1].exeexecutable
MD5:6C5EA5A82D756BCA4A9610C8D2260D2F
SHA256:B9CD71B275AF11B63C33457B0F43F2F2675937070C563E195F223EFD7FA4C74B
4628quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CE7B026C819922EDB9B7ED78605E20A3_731147EC87359F0E7CBB8FC748CE2C9Abinary
MD5:8843F1AE49584247BE4128757E5E5500
SHA256:903F16DAFC8BCDA73B59E9328A3C2FFE4DD350543D847ED50E2EE4B8BF6526CE
4628quicksoftware-dl.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\urllist[1].txttext
MD5:F71E3833F698C3C62409469692A5446B
SHA256:CFC2233ED169E5BEA2B1D9F04538F24B602B8ECC9016896300A6D5D5C59C7627
4628quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CE7B026C819922EDB9B7ED78605E20A3_731147EC87359F0E7CBB8FC748CE2C9Abinary
MD5:C1EE51398687C0DFF82034211587B60A
SHA256:F59CE236F8A5010BB66F4791B768B55D28C1644AE3EEF778E864103E77ACAC38
4628quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsoA655.tmp\System.dllexecutable
MD5:9B38A1B07A0EBC5C7E59E63346ECC2DB
SHA256:C881253DAFCF1322A771139B1A429EC1E78C507CA81A218A20DC1A4B25ABBFE7
4628quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_786EA6C36BF7ABFF201B638497282D19binary
MD5:2EAA0859782ED877B89881411A4D2CA1
SHA256:A2F3DFD9E9644901A5807E03AF713A1FCE517D79B2170CA1C4048302E15A3326
4628quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsoA655.tmp\INetC.dllexecutable
MD5:40D7ECA32B2F4D29DB98715DD45BFAC5
SHA256:85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
4628quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsoA655.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
4628quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsoA655.tmp\modern-header.bmpimage
MD5:583C38FB0F5AF5FE584D9A9B01D6A3E7
SHA256:4C9E804CE1A391F8E603B7B9C732A6529C1E81BE4D12F125C8562EA9D49095C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
196
DNS requests
226
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5796
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4628
quicksoftware-dl.exe
GET
200
18.173.205.113:80
http://ocsps.ssl.com/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBQMDtATfnJO6JAXDQoHl8pAaJdhTQQU3QQJB6L1en1SUxKSle44gCUNplkCCAmX7RCdHwf8
unknown
—
—
whitelisted
4628
quicksoftware-dl.exe
GET
200
18.173.205.113:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTUkpS%2BK0oZhSMx%2FmmCZ76UqdjUxQQUJhR%2B4NzXpvfi1AQn32HxwuznMsoCEFv%2BMpErdkO9Fsl4vDuI1mA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
3.167.227.115:80
http://r11.c.lencr.org/87.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
756
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
756
lsass.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
864
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5796
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5796
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4628
quicksoftware-dl.exe
139.84.173.225:443
files.webdevtest.ftp.sh
AS-CHOOPA
US
unknown
4628
quicksoftware-dl.exe
18.173.205.113:80
ocsps.ssl.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.78
whitelisted
files.webdevtest.ftp.sh
  • 139.84.173.225
unknown
ocsps.ssl.com
  • 18.173.205.113
  • 18.173.205.43
  • 18.173.205.57
  • 18.173.205.76
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
7-zip.org
  • 49.12.202.237
unknown
github.com
  • 140.82.121.4
whitelisted
netcologne.dl.sourceforge.net
  • 78.35.24.122
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ftp .sh Domain
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
quicksoftware-dl.exe