File name:

aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe

Full analysis: https://app.any.run/tasks/2ad6fcc4-54c7-4e8b-b9ca-22e42e4ef1c5
Verdict: Malicious activity
Analysis date: February 20, 2025, 18:50:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

58052F2B38E6AFC9F2CE2A56BC022710

SHA1:

553AB22DC221E09F5B770EB9406D5C1632C539B0

SHA256:

BCAAD1F82EBD51908B75EF4A2F0AC32B31FA1BE2488F466E238A103F6A1C7BE3

SSDEEP:

49152:x4aEyhXG3Ga6M7R37Wyvg4SwDgTJuJsAuPDKBhjlag1m5Rfzi8AGIqTtaSTGRaf:xIyzTUrtvRS4gI/SDKBhjQ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • AppLauncher.exe (PID: 6840)
      • AppLauncher.exe (PID: 6904)

    • Registers / Runs the DLL via REGSVR32.EXE

      • AppLauncher.exe (PID: 6840)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • Checks Windows Trust Settings

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • There is functionality for taking screenshot (YARA)

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • The process drops C-runtime libraries

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • Uses TASKKILL.EXE to kill process

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • Process drops legitimate windows executable

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • Executable content was dropped or overwritten

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • jcef_helper.exe (PID: 4304)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6872)

    • Creates a software uninstall entry

      • AppLauncher.exe (PID: 6840)

    • Detected use of alternative data streams (AltDS)

      • AppLauncher.exe (PID: 6904)

  • INFO

    • The sample compiled with english language support

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • jcef_helper.exe (PID: 4304)

    • Reads the computer name

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • jcef_helper.exe (PID: 3696)
      • AppLauncher.exe (PID: 6904)
      • jcef_helper.exe (PID: 5872)

    • Checks supported languages

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • AppLauncher.exe (PID: 6840)
      • jcef_helper.exe (PID: 6504)
      • AppLauncher.exe (PID: 6904)
      • jcef_helper.exe (PID: 6572)
      • jcef_helper.exe (PID: 6544)
      • jcef_helper.exe (PID: 5872)
      • jcef_helper.exe (PID: 3696)
      • jcef_helper.exe (PID: 6516)
      • jcef_helper.exe (PID: 4304)

    • Reads the machine GUID from the registry

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • AppLauncher.exe (PID: 6904)

    • Reads the software policy settings

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)

    • Checks proxy server information

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • AppLauncher.exe (PID: 6904)

    • Creates files or folders in the user directory

      • aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe (PID: 5256)
      • AppLauncher.exe (PID: 6904)

    • Process checks computer location settings

      • AppLauncher.exe (PID: 6904)
      • jcef_helper.exe (PID: 6504)
      • jcef_helper.exe (PID: 6544)
      • jcef_helper.exe (PID: 6572)

    • Reads CPU info

      • AppLauncher.exe (PID: 6904)

    • Create files in a temporary directory

      • AppLauncher.exe (PID: 6904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:12 16:33:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1739776
InitializedDataSize: 627200
UninitializedDataSize: -
EntryPoint: 0x16f75a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 8.5.21.2
ProductVersionNumber: 8.5.21.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Saba Software, Inc.
FileDescription: SabaMeetingInstallerLauncher.exe
FileVersion: 8,5,21,2
InternalName: SabaMeetingInstallerLauncher.exe
LegalCopyright: c2022 Saba Software, Inc.
OriginalFileName: SabaMeetingInstallerLauncher.exe
ProductName: SabaMeetingInstallerLauncher.exe
ProductVersion: 8,5,21,2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ahr0chm6ly9zcgnldtiuc2fiyw1lzxrpbmcuy29tp2x0b2s9u1vwuljct1lwwehwm1pj_appsetup.exe taskkill.exe no specs conhost.exe no specs applauncher.exe no specs regsvr32.exe no specs regsvr32.exe no specs applauncher.exe jcef_helper.exe no specs jcef_helper.exe jcef_helper.exe no specs jcef_helper.exe no specs jcef_helper.exe no specs jcef_helper.exe no specs jcef_helper.exe

Process information

PID
CMD
Path
Indicators
Parent process
3696"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --mojo-platform-channel-handle=3284 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:8C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe
AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
4304"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --mojo-platform-channel-handle=4992 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:8C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe
AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Exit code:
0
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
5256"C:\Users\admin\AppData\Local\Temp\aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe" C:\Users\admin\AppData\Local\Temp\aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe
explorer.exe
User:
admin
Company:
Saba Software, Inc.
Integrity Level:
MEDIUM
Description:
SabaMeetingInstallerLauncher.exe
Exit code:
0
Version:
8,5,21,2
Modules
Images
c:\users\admin\appdata\local\temp\ahr0chm6ly9zcgnldtiuc2fiyw1lzxrpbmcuy29tp2x0b2s9u1vwuljct1lwwehwm1pj_appsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5872"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --mojo-platform-channel-handle=3008 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:2C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe—AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6504"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4648 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:1C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe—AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6516"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --mojo-platform-channel-handle=1620 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:8C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe—AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6544"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4520 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:1C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe—AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6572"C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\admin\AppData\Roaming\Centra\App\bin\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4532 --field-trial-handle=3012,i,16266820637043472706,5675427381970302881,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:1C:\Users\admin\AppData\Roaming\Centra\App\bin\jcef_helper.exe—AppLauncher.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Java Chromium Embedded Framework (JCEF) Helper
Version:
116.0.9.311+ga0af101
Modules
Images
c:\users\admin\appdata\roaming\centra\app\bin\jcef_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\centra\app\bin\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6688taskkill /F /T /IM EdgeConnector.exeC:\Windows\SysWOW64\taskkill.exe—aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 557
Read events
2 526
Write events
31
Delete events
0

Modification events

(PID) Process:(5256) aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5256) aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5256) aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6872) regsvr32.exeKey:HKEY_CLASSES_ROOT\AppID\npSabaMeetingPlugin4.dll
Operation:writeName:AppID
Value:
{B415CD14-B45D-4BCA-B552-B06175C38606}
(PID) Process:(6872) regsvr32.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{f8f4fab6-14dc-5a39-96f4-c7cbf5e4b418}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(6872) regsvr32.exeKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{f8f4fab6-14dc-5a39-96f4-c7cbf5e4b418}
Operation:writeName:AppID
Value:
{B415CD14-B45D-4BCA-B552-B06175C38606}
(PID) Process:(6872) regsvr32.exeKey:HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-sabameeting-plugin
Operation:writeName:Extension
Value:
(PID) Process:(6872) regsvr32.exeKey:HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-sabameeting-plugin
Operation:writeName:CLSID
Value:
{f8f4fab6-14dc-5a39-96f4-c7cbf5e4b418}
(PID) Process:(6872) regsvr32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f8f4fab6-14dc-5a39-96f4-c7cbf5e4b418}\iexplore
Operation:writeName:Count
Value:
0
(PID) Process:(6872) regsvr32.exeKey:HKEY_CURRENT_USER\SOFTWARE\MozillaPlugins\saba.com/SabaMeetingPlugin
Operation:writeName:Path
Value:
C:\Users\admin\AppData\Roaming\Centra\App\bin\npSabaMeetingPlugin4.dll
Executable files
145
Suspicious files
103
Text files
192
Unknown types
0

Dropped files

PID
Process
Filename
Type
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\SignedAppSetup[1].7z —
MD5:—
SHA256:—
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\Roaming\Centra\App\tmp.7z —
MD5:—
SHA256:—
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\Roaming\Centra\App\AppSetup.7z —
MD5:—
SHA256:—
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77binary
MD5:3E4F1F35585463D575AB8FC462E7C209
SHA256:4209AA9837516CFACEAD2AA4A6D6335FEB2222376821F468C40F1FD5AADF9C9D
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77binary
MD5:C4E4FBE427CF453FB9BF4599008A2E58
SHA256:A65539908CBD54ECAD26373FC1360805388E8F2AAA2C262B01DC7AFAA7E3241F
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_430B665B82575023BF0ADADC3F780A77binary
MD5:D5886CDA8BB901105A810B6E496C72CC
SHA256:6B88983A34D219993E75AB8C7E8DC08EB40034CE181E0D971551871F2BFE8691
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\Roaming\Centra\App\jre\legal\javafx.controls\ADDITIONAL_LICENSE_INFOtext
MD5:494903D6ADD168A732E73D7B0BA059A0
SHA256:0A256A7133BD2146482018BA6204A4ECC75836C139C8792DA53536A9B67071D4
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\Roaming\Centra\App\jre\legal\javafx.web\ADDITIONAL_LICENSE_INFOtext
MD5:494903D6ADD168A732E73D7B0BA059A0
SHA256:0A256A7133BD2146482018BA6204A4ECC75836C139C8792DA53536A9B67071D4
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_430B665B82575023BF0ADADC3F780A77binary
MD5:DD7F04BEE00E989B1F114003D7937887
SHA256:BE339A921498976ABAEA1FFE96ACF1D6F3CF55D1B348BC980F2D79DEC30E1A55
5256aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exeC:\Users\admin\AppData\Roaming\Centra\App\jre\legal\javafx.base\ADDITIONAL_LICENSE_INFOtext
MD5:71BB3AD0017BF36D14BB96A8D4B32C45
SHA256:A69BCE275BA7A3570AF6579CB0F55682CD75FEDFCD49E0E8E9022270C447C916
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
39
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
104.124.11.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5256
aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D
unknown
—
—
whitelisted
5256
aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQLqIKj6Gi5thHaqKC1ECU9aXsCRQQUmvMr2s%2BtT7YvuypISCoStxtCwSQCEQDtdSS1%2FdRObOClq0IIcrWm
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6308
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6308
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
836
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_win64_dldxogwi36sxwpr57ta4lg57z4.crx3
unknown
—
—
whitelisted
836
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_win64_dldxogwi36sxwpr57ta4lg57z4.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4712
MoUsoCoreWorker.exe
104.124.11.58:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
104.119.109.218:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5256
aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe
185.84.1.141:443
spceu2.sabameeting.com
SABA-AS-001
GB
unknown
5256
aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
whitelisted
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
crl.microsoft.com
  • 104.124.11.58
  • 104.124.11.17
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.microsoft.com
  • 104.119.109.218
  • 2.23.246.101
whitelisted
spceu2.sabameeting.com
  • 185.84.1.141
unknown
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.20
  • 20.190.160.131
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.3
  • 20.190.160.64
  • 20.190.160.66
whitelisted
go.microsoft.com
  • 2.19.246.123
whitelisted

Threats

No threats detected
Process
Message
AppLauncher.exe
[0220/185144.891:WARNING:chrome_browser_cloud_management_controller.cc(88)] Could not create policy manager as CBCM is not enabled.
AppLauncher.exe
[0220/185155.496:INFO:CONSOLE(1)] "Loading scriptAdapter.js", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (1)
AppLauncher.exe
[0220/185155.611:INFO:CONSOLE(1)] "Loading scriptAdapter.js", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (1)
AppLauncher.exe
[0220/185155.649:INFO:CONSOLE(20)] "SUCCESS: {"chatId":"0","saveAs":"Save As...","edit":"Edit message","clientFontFamily":"roboto","isPresenter":"false","isTextChatSaveEnabled":"true","clear":"Clear all messages","copyAll":"CopyAll","copy":"Copy","delete":"Delete message"}", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
AppLauncher.exe
[0220/185155.653:INFO:CONSOLE(20)] "SUCCESS: {"timeStamp":"Show Time Stamp","isAtBottom":"true","isLTR":"true","scrollPosition":"-1","isJCEFBrowser":"true"}", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
AppLauncher.exe
[0220/185155.654:INFO:CONSOLE(20)] "SUCCESS: []", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
AppLauncher.exe
[0220/185155.656:INFO:CONSOLE(20)] "SUCCESS: false", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
AppLauncher.exe
[0220/185155.660:INFO:CONSOLE(20)] "SUCCESS: ", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
AppLauncher.exe
[0220/185156.501:INFO:CONSOLE(20)] "SUCCESS: {"eventID":null,"contentText":"Use this wizard to upload PowerPoint slides or other agenda content for this meeting","phoneNumberLabel":"Phone number:","eventIdLabel":"Meeting ID:","inviteTitle":"INVITE PEOPLE","endTimeLabel":"End:","audioText":"Use this wizard to test and adjust your microphone and audio setting","conferenceID":" ","clientFontFamily":"roboto","accessCodeLabel":"Access code:","appshareText":"Start sharing your desktop now","eventName":"Test Event","startTimeLabel":"Start:","startTime":"02-20-2025, 12:00AM","audioTitle":"ADJUST AUDIO","testEventDesc":"You have successfully joined the test event, please test out audio and video below, and exit when complete","appshareTitle":"START APPSHARE","started":"false","contentTitle":"ADD CONTENT","eventType":"3","videoTitle":"TEST VIDEO","testEventTitle":"Congratulations!","phoneNumber":" ","startedStr":"Your meeting has not yet started.","endTime":"02-20-2025, 01:00AM","videoText":"Use this wizard to test your Camera","inviteText":"Use this wizard to invite attendees to this meeting by email"}", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
AppLauncher.exe
[0220/185156.516:INFO:CONSOLE(20)] "SUCCESS: ", source: file:///C:/Users/admin/AppData/Local/Temp/sm_tmp_5592621862534705027/Resources/scriptAdapter.js (20)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
aHR0cHM6Ly9zcGNldTIuc2FiYW1lZXRpbmcuY29tP2x0b2s9U1VWUlJCT1lWWEhWM1pJ_AppSetup.exe