File name:

realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe.7z

Full analysis: https://app.any.run/tasks/ab953a2b-3726-4a37-bb91-ee378e25a011
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 02, 2024, 20:24:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

DE6173D4CBED95824E65EB9602B2A4BC

SHA1:

4E7F54545368C94D43AC9B724102B82C6AED326A

SHA256:

B865DA61692E83859A59D7CB9C6A86951C32F7BB211DF424BF5BF4BD574C8976

SSDEEP:

49152:9nh47Kb5hqH6bAvvIA1OcT2jQ1ExxOsS4ck+xpwDyyxjYMH8QSgttM3LA9YY9bb5:RLnbAvwAkceqpsrEj0y4jY0++799hLj7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1264)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3000)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3632)
      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • avg_antivirus_free_setup.exe (PID: 2512)
      • icarus.exe (PID: 2160)
      • realtek-hd-audio-drivers-x64-2.82-installer.exe (PID: 3700)
      • icarus.exe (PID: 2328)
      • Setup.exe (PID: 3516)

    • Antivirus name has been found in the command line (generic signature)

      • avg_antivirus_free_setup.exe (PID: 2512)
      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • icarus.exe (PID: 2328)
      • icarus.exe (PID: 2304)

    • Creates a writable file in the system directory

      • icarus.exe (PID: 2328)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3000)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3632)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • avg_antivirus_free_setup.exe (PID: 2512)
      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • realtek-hd-audio-drivers-x64-2.82-installer.exe (PID: 3700)
      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2328)
      • Setup.exe (PID: 3516)

    • Reads settings of System Certificates

      • avg_antivirus_free_setup.exe (PID: 2512)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • avg_antivirus_free_online_setup.exe (PID: 3796)

    • Reads the Windows owner or organization settings

      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • Setup.exe (PID: 3516)

    • Starts itself from another location

      • icarus.exe (PID: 2160)

    • Drops a system driver (possible attempt to evade defenses)

      • realtek-hd-audio-drivers-x64-2.82-installer.exe (PID: 3700)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 2328)
      • realtek-hd-audio-drivers-x64-2.82-installer.exe (PID: 3700)

    • Application launched itself

      • Setup.exe (PID: 3724)

    • Creates/Modifies COM task schedule object

      • Setup.exe (PID: 3516)

    • Reads Internet Explorer settings

      • Setup.exe (PID: 3516)

    • Checks Windows Trust Settings

      • Setup.exe (PID: 3516)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 2328)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 2328)

    • Reads the Internet Settings

      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)

    • Adds/modifies Windows certificates

      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)

    • The process verifies whether the antivirus software is installed

      • icarus.exe (PID: 2328)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3988)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3000)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 908)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3632)
      • avg_antivirus_free_setup.exe (PID: 2512)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • realtek-hd-audio-drivers-x64-2.82-installer.exe (PID: 3700)
      • icarus.exe (PID: 2160)
      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • icarus.exe (PID: 2328)
      • icarus.exe (PID: 2304)
      • Setup.exe (PID: 3724)
      • Setup.exe (PID: 3516)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3988)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 908)
      • avg_antivirus_free_setup.exe (PID: 2512)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2304)
      • icarus.exe (PID: 2328)
      • Setup.exe (PID: 3724)
      • Setup.exe (PID: 3516)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3988)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3000)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1264)

    • Create files in a temporary directory

      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3000)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe (PID: 3632)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • realtek-hd-audio-drivers-x64-2.82-installer.exe (PID: 3700)
      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2304)
      • icarus.exe (PID: 2328)
      • Setup.exe (PID: 3516)

    • Reads the machine GUID from the registry

      • avg_antivirus_free_setup.exe (PID: 2512)
      • realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp (PID: 3608)
      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2328)
      • icarus.exe (PID: 2304)
      • Setup.exe (PID: 3516)

    • Creates files in the program directory

      • avg_antivirus_free_online_setup.exe (PID: 3796)
      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2328)
      • Setup.exe (PID: 3516)

    • Reads CPU info

      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2304)
      • icarus.exe (PID: 2328)

    • Dropped object may contain TOR URL's

      • icarus.exe (PID: 2160)
      • icarus.exe (PID: 2328)

    • Reads Environment values

      • icarus.exe (PID: 2328)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 3516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
14
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe wmpnscfg.exe no specs realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.exe realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.tmp no specs realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.exe realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.tmp avg_antivirus_free_setup.exe avg_antivirus_free_online_setup.exe realtek-hd-audio-drivers-x64-2.82-installer.exe icarus.exe icarus.exe no specs icarus.exe setup.exe no specs setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
908"C:\Users\admin\AppData\Local\Temp\is-85LVD.tmp\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp" /SL5="$1C0186,837439,832512,C:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe" C:\Users\admin\AppData\Local\Temp\is-85LVD.tmp\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp—realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-85lvd.tmp\realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1264"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2160C:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\icarus-info.xml /install /silent /ws /psh:92pTu5f8VcWtTaZmGBfBw7CmFIM0dLZH4Ev9f7EhSFnrCLrgNn3eJnkJr05RKqwAMeQR38QnI4Auzk /cookie:mmm_irs_ppi_902_451_o /track-guid:d071c536-760b-42a2-a13e-1f3a66596305 /edat_dir:C:\Windows\Temp\asw.c7cd975183c4421cC:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\common\icarus.exe
avg_antivirus_free_online_setup.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
HIGH
Description:
AVG Installer
Exit code:
0
Version:
23.8.6421.0
Modules
Images
c:\windows\temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\common\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2304C:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\avg-av-vps\icarus.exe /silent /ws /psh:92pTu5f8VcWtTaZmGBfBw7CmFIM0dLZH4Ev9f7EhSFnrCLrgNn3eJnkJr05RKqwAMeQR38QnI4Auzk /cookie:mmm_irs_ppi_902_451_o /track-guid:d071c536-760b-42a2-a13e-1f3a66596305 /edat_dir:C:\Windows\Temp\asw.c7cd975183c4421c /er_master:master_ep_d0d1fd26-ad4d-4892-810b-85abb02189d1 /er_ui:ui_ep_3f001817-652d-47da-a308-b135fceb7f90 /er_slave:avg-av-vps_slave_ep_0a7cafe4-f391-4d35-b333-0238fcbfb246 /slave:avg-av-vpsC:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\avg-av-vps\icarus.exe—icarus.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
HIGH
Description:
AVG Installer
Exit code:
0
Version:
23.8.6421.0
Modules
Images
c:\windows\temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\avg-av-vps\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2328C:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\avg-av\icarus.exe /silent /ws /psh:92pTu5f8VcWtTaZmGBfBw7CmFIM0dLZH4Ev9f7EhSFnrCLrgNn3eJnkJr05RKqwAMeQR38QnI4Auzk /cookie:mmm_irs_ppi_902_451_o /track-guid:d071c536-760b-42a2-a13e-1f3a66596305 /edat_dir:C:\Windows\Temp\asw.c7cd975183c4421c /er_master:master_ep_d0d1fd26-ad4d-4892-810b-85abb02189d1 /er_ui:ui_ep_3f001817-652d-47da-a308-b135fceb7f90 /er_slave:avg-av_slave_ep_2d632347-b434-49a7-af02-f92f36d55043 /slave:avg-avC:\Windows\Temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\avg-av\icarus.exe
icarus.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
HIGH
Description:
AVG Installer
Exit code:
0
Version:
23.8.6421.0
Modules
Images
c:\windows\temp\asw-d5cb8a5b-0ba3-44a7-8536-a69209f5459c\avg-av\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2512"C:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\component0_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5f8VcWtTaZmGBfBw7CmFIM0dLZH4Ev9f7EhSFnrCLrgNn3eJnkJr05RKqwAMeQR38QnI4AuzkC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\component0_extract\avg_antivirus_free_setup.exe
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Installer
Exit code:
0
Version:
2.1.99.0
Modules
Images
c:\users\admin\appdata\local\temp\is-doj3j.tmp\component0_extract\avg_antivirus_free_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3000"C:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe" C:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Softonic International SA
Exit code:
0
Version:
5.13.0.7339
Modules
Images
c:\users\admin\desktop\realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3516C:\Users\admin\AppData\Local\Temp\pftE17F~tmp\Setup.exe -deleter C:\Users\admin\AppData\Local\Temp\pftE17F~tmp\Setup.exe
Setup.exe
User:
admin
Company:
Macrovision Corporation
Integrity Level:
HIGH
Description:
Setup.exe
Exit code:
4294962281
Version:
11.50.42618
Modules
Images
c:\users\admin\appdata\local\temp\pfte17f~tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3608"C:\Users\admin\AppData\Local\Temp\is-H5BIA.tmp\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp" /SL5="$F0174,837439,832512,C:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe" /SPAWNWND=$110152 /NOTIFYWND=$1C0186 C:\Users\admin\AppData\Local\Temp\is-H5BIA.tmp\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-h5bia.tmp\realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3632"C:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe" /SPAWNWND=$110152 /NOTIFYWND=$1C0186 C:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Softonic International SA
Exit code:
0
Version:
5.13.0.7339
Modules
Images
c:\users\admin\desktop\realtek-hd-audio-drivers-x64-2.82-installer_zl-ymi1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
18 617
Read events
17 979
Write events
92
Delete events
546

Modification events

(PID) Process:(1264) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3608) realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
397
Suspicious files
177
Text files
96
Unknown types
1

Dropped files

PID
Process
Filename
Type
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\is-L20J0.tmp —
MD5:—
SHA256:—
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\realtek-hd-audio-drivers-x64-2.82-installer.exe —
MD5:—
SHA256:—
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\Downloads\realtek-hd-audio-drivers-x64-2.82-installer.exe —
MD5:—
SHA256:—
3000realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exeC:\Users\admin\AppData\Local\Temp\is-85LVD.tmp\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpexecutable
MD5:BFA46CB770746DB05BC27DB23375309F
SHA256:4EAC72134DA7D6F7B70761467659FA6EFA13DC9B8EE285E4376A621C6FFAD06F
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\AVG_AV.pngimage
MD5:5EF5291810C454A35F76D976105F37CC
SHA256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\is-46QCQ.tmpimage
MD5:46D625794FC796A4E7621E0FF4C224C6
SHA256:73687B99AE4B318847BC2CC636747916B6B41FD1B1E4C97A47EC385215CFF8A8
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\mainlogo.pngimage
MD5:46D625794FC796A4E7621E0FF4C224C6
SHA256:73687B99AE4B318847BC2CC636747916B6B41FD1B1E4C97A47EC385215CFF8A8
1264WinRAR.exeC:\Users\admin\Desktop\realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exeexecutable
MD5:95239C01E7A420FBBDF652EBA175A598
SHA256:88B61337112CE4EC492444C64A3106EF9CCA95849DECDDD8BFF4F02FA08F61DD
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:BD7C54187922591B52AF4387F6AC40B2
SHA256:8DF790B7F4F32E0D659CDCD31774D84DA1EEB78FF8CEAC58B1A54DF1F072FAC3
3608realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmpC:\Users\admin\AppData\Local\Temp\is-DOJ3J.tmp\is-T793E.tmpimage
MD5:5EF5291810C454A35F76D976105F37CC
SHA256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
35
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
GET
200
184.25.50.34:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7267af0a53dc8941
unknown
compressed
65.2 Kb
unknown
2512
avg_antivirus_free_setup.exe
POST
200
142.250.185.206:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
2512
avg_antivirus_free_setup.exe
POST
200
142.250.185.206:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
2512
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
unknown
2512
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
18.173.184.9:443
dml722f3h8f7x.cloudfront.net
—
US
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
13.226.150.12:443
d1r1qou28c7cqg.cloudfront.net
AMAZON-02
US
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
108.138.34.30:443
d1dasekmsevug8.cloudfront.net
AMAZON-02
US
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
23.67.132.99:443
images.sftcdn.net
AKAMAI-AS
DE
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
184.25.50.34:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
199.232.194.133:443
gsf-fl.softonic.com
FASTLY
US
unknown
3608
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.tmp
108.138.34.181:443
d1dasekmsevug8.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
dml722f3h8f7x.cloudfront.net
  • 18.173.184.9
  • 18.173.184.23
  • 18.173.184.16
  • 18.173.184.147
unknown
d1r1qou28c7cqg.cloudfront.net
  • 13.226.150.12
  • 13.226.150.96
  • 13.226.150.134
  • 13.226.150.156
  • 18.66.188.50
  • 18.66.188.170
  • 18.66.188.28
  • 18.66.188.229
unknown
d1dasekmsevug8.cloudfront.net
  • 108.138.34.30
  • 108.138.34.41
  • 108.138.34.181
  • 108.138.34.177
unknown
images.sftcdn.net
  • 23.67.132.99
whitelisted
ctldl.windowsupdate.com
  • 184.25.50.34
  • 184.25.50.17
  • 184.25.50.25
  • 184.25.50.26
  • 184.25.51.120
  • 184.25.51.96
  • 184.25.50.8
  • 184.25.51.115
  • 184.25.50.16
whitelisted
gsf-fl.softonic.com
  • 199.232.194.133
  • 199.232.198.133
whitelisted
honzik.avcdn.net
  • 23.32.97.64
  • 2a02:26f0:3100:1aa::240d
  • 2a02:26f0:3100:1a3::240d
unknown
v7event.stats.avast.com
  • 34.117.223.223
whitelisted
www.google-analytics.com
  • 142.250.185.206
whitelisted
analytics.avcdn.net
  • 34.117.223.223
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
realtek-hd-audio-drivers-x64-2.82-installer_ZL-Ymi1.exe.7z