File name:

toad-for-mysql-8.0.0-installer_XL9-WR1.exe

Full analysis: https://app.any.run/tasks/eef112eb-75be-4dc7-ae4b-684a61692c8d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 27, 2024, 04:49:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-html
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

AC8CA19033E167CAE06E3AB4A5E242C5

SHA1:

8794E10C8F053B5709F6610F85FCAED2A142E508

SHA256:

D6EFEB15923AC6C89B65F87A0486E18E0B7C5BFF0D4897173809D1515A9ED507

SSDEEP:

98304:EPIRMu5DUrszskSGjKuV3XNr/g4T6Gq+flu+eSce/Unba+O+CB3jD9hl3:r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • installer.exe (PID: 1380)
      • installer.exe (PID: 5776)

    • Reads security settings of Internet Explorer

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 5776)
      • uihost.exe (PID: 4824)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 6368)
      • servicehost.exe (PID: 5712)
      • installer.exe (PID: 5776)
      • uihost.exe (PID: 4824)
      • updater.exe (PID: 6076)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 1380)
      • installer.exe (PID: 5776)
      • uihost.exe (PID: 4824)
      • cmd.exe (PID: 6340)
      • updater.exe (PID: 6076)
      • cmd.exe (PID: 6824)
      • cmd.exe (PID: 7080)
      • servicehost.exe (PID: 5712)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 6368)
      • servicehost.exe (PID: 5712)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 5776)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 5776)
      • servicehost.exe (PID: 5712)

    • Executes as Windows Service

      • servicehost.exe (PID: 5712)

    • Creates a software uninstall entry

      • servicehost.exe (PID: 5712)
      • installer.exe (PID: 5776)

    • Process drops legitimate windows executable

      • installer.exe (PID: 5776)

    • Hides command output

      • cmd.exe (PID: 6340)

    • Reads Mozilla Firefox installation path

      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)

    • Searches for installed software

      • updater.exe (PID: 6076)
      • explorer.exe (PID: 6208)

    • Starts CMD.EXE for commands execution

      • servicehost.exe (PID: 5712)
      • updater.exe (PID: 6076)

  • INFO

    • Checks supported languages

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 1380)
      • SearchApp.exe (PID: 5064)
      • installer.exe (PID: 5776)
      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)
      • updater.exe (PID: 6076)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • The sample compiled with english language support

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • installer.exe (PID: 5776)
      • installer.exe (PID: 1380)

    • Sends debugging messages

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 5776)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Reads the machine GUID from the registry

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • SearchApp.exe (PID: 5064)
      • installer.exe (PID: 5776)
      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)
      • updater.exe (PID: 6076)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Reads the software policy settings

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 5776)
      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)
      • SearchApp.exe (PID: 5064)
      • updater.exe (PID: 6076)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Reads the computer name

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 5776)
      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)
      • updater.exe (PID: 6076)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Checks proxy server information

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Create files in a temporary directory

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 5776)

    • The process uses the downloaded file

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Creates files in the program directory

      • saBSI.exe (PID: 6368)
      • installer.exe (PID: 1380)
      • installer.exe (PID: 5776)
      • servicehost.exe (PID: 5712)
      • uihost.exe (PID: 4824)

    • Process checks computer location settings

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6660)
      • SearchApp.exe (PID: 5064)
      • uihost.exe (PID: 4824)
      • servicehost.exe (PID: 5712)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 6208)

    • Manual execution by a user

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6668)
      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)

    • Reads CPU info

      • toad-for-mysql-8.0.0-installer_XL9-WR1.exe (PID: 6624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:31 15:04:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 2143744
InitializedDataSize: 2316288
UninitializedDataSize: -
EntryPoint: 0x1c118b
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.0.11.0
ProductVersionNumber: 3.0.11.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Softonic
FileDescription: Softonic
FileVersion: 3.0.11.0.0
LegalCopyright: (c) Softonic
ProductName: Softonic
ProductVersion: 3.0.11.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
20
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start toad-for-mysql-8.0.0-installer_xl9-wr1.exe sabsi.exe installer.exe installer.exe servicehost.exe uihost.exe explorer.exe no specs COpenControlPanel no specs updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs COpenControlPanel no specs toad-for-mysql-8.0.0-installer_xl9-wr1.exe no specs toad-for-mysql-8.0.0-installer_xl9-wr1.exe searchapp.exe toad-for-mysql-8.0.0-installer_xl9-wr1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1380"C:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\installer.exe
saBSI.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\isv68df.tmp\sabsi\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4308C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
4824"C:\Program Files\McAfee\WebAdvisor\UIHost.exe" C:\Program Files\McAfee\WebAdvisor\uihost.exe
servicehost.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
MEDIUM
Description:
McAfee WebAdvisor(user level process)
Version:
4,1,1,995
Modules
Images
c:\program files\mcafee\webadvisor\uihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5064"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5712"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\servicehost.exe
services.exe
User:
SYSTEM
Company:
McAfee, LLC
Integrity Level:
SYSTEM
Description:
McAfee WebAdvisor(service)
Version:
4,1,1,995
Modules
Images
c:\program files\mcafee\webadvisor\servicehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5776"C:\Program Files\McAfee\Temp4127649205\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\Program Files\McAfee\Temp4127649205\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,995
Modules
Images
c:\program files\mcafee\temp4127649205\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6076"C:\Program Files\McAfee\WebAdvisor\updater.exe" C:\Program Files\McAfee\WebAdvisor\updater.exe
servicehost.exe
User:
SYSTEM
Company:
McAfee, LLC
Integrity Level:
SYSTEM
Description:
McAfee WebAdvisor(updater)
Exit code:
0
Version:
4,1,1,995
Modules
Images
c:\program files\mcafee\webadvisor\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6208C:\WINDOWS\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
Total events
55 041
Read events
54 540
Write events
481
Delete events
20

Modification events

(PID) Process:(6660) toad-for-mysql-8.0.0-installer_XL9-WR1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E8070C0005001B00040032002B000B02010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(6660) toad-for-mysql-8.0.0-installer_XL9-WR1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000316BD2E21A58DB01
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor\Settings
Operation:writeName:affid_override_disabled
Value:
SYSTEM,BOOL,TRUE
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor\Settings
Operation:writeName:*Affid
Value:
SYSTEM,STR,91082
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:UUID
Value:
{920C6706-0F53-410E-AC74-0424B55D4477}
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallerFlags
Value:
1
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallationStatus
Value:
PENDING
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallationID
Value:
UNDEFINED
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:CountryCode
Value:
DE
(PID) Process:(6368) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:NEW_USER_STATE
Value:
EXPIRED
Executable files
19
Suspicious files
268
Text files
975
Unknown types
15

Dropped files

PID
Process
Filename
Type
6660toad-for-mysql-8.0.0-installer_XL9-WR1.exeC:\Users\admin\Downloads\toad-for-mysql-8.0.0-installer.exe —
MD5:—
SHA256:—
1380installer.exeC:\Program Files\McAfee\Temp4127649205\browserplugin.cab —
MD5:—
SHA256:—
1380installer.exeC:\Program Files\McAfee\Temp4127649205\l10n.cabcompressed
MD5:4C8E546D932FC567FA9A68C82F938E6E
SHA256:BC88EE7B453E250F66B4FBD42BFB76176AE98A30583742302D26477E3D422206
1380installer.exeC:\Program Files\McAfee\Temp4127649205\mcafeecerts.xmlxml
MD5:D0CD30BD9B02F33B222FF8A846821D4B
SHA256:1CC3969AEF3DC3DC2330DB0386C6C27C09A58D078689D8D97D900A2B9ABE31A0
6660toad-for-mysql-8.0.0-installer_XL9-WR1.exeC:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI.zipcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
6660toad-for-mysql-8.0.0-installer_XL9-WR1.exeC:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\saBSI.exeexecutable
MD5:143255618462A577DE27286A272584E1
SHA256:F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
1380installer.exeC:\Program Files\McAfee\Temp4127649205\analyticstelemetry.cabcompressed
MD5:A15CF0E1FEA6C857CD90A27073009053
SHA256:63B731A170F3EEC34F4EEDFC1727F9C6343C0AE2F981783873C638F9A8F16EBF
1380installer.exeC:\Program Files\McAfee\Temp4127649205\analyticsmanager.cabcompressed
MD5:D879D97ACF98B6EC553731A91D9FCD1C
SHA256:D5D6D579965CB2E231AF81A2BF60A39A1955EC3782F27D9B1B8177F87B202C94
1380installer.exeC:\Program Files\McAfee\Temp4127649205\browserhost.cabcompressed
MD5:F81CD9F1599139C5DE0CCD3B13285927
SHA256:808E5DFBAF55691037A992E719F1FBF5BF5FB40F8D6440D0706F27D4E7FB9CE2
1380installer.exeC:\Program Files\McAfee\Temp4127649205\balloon_safe_annotation.pngimage
MD5:2048DF489A12C4C9E2341BEF42883205
SHA256:DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
82
DNS requests
48
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3884
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3884
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6264
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6264
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5000
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5064
SearchApp.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3884
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3884
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1176
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.179
  • 2.21.110.139
  • 2.21.110.146
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.206
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.64
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.20
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
di7e1j5f1plfo.cloudfront.net
  • 18.245.78.212
  • 18.245.78.188
  • 18.245.78.185
  • 18.245.78.145
whitelisted
images.sftcdn.net
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.129.91
  • 151.101.193.91
whitelisted

Threats

No threats detected
Process
Message
toad-for-mysql-8.0.0-installer_XL9-WR1.exe
LoadingPage
toad-for-mysql-8.0.0-installer_XL9-WR1.exe
WelcomePage
toad-for-mysql-8.0.0-installer_XL9-WR1.exe
ProductPage
toad-for-mysql-8.0.0-installer_XL9-WR1.exe
DownloadPageDLM
toad-for-mysql-8.0.0-installer_XL9-WR1.exe
FinishPageDLM
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\ISV68DF.tmp\saBSI\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
toad-for-mysql-8.0.0-installer_XL9-WR1.exe