File name:

PixelSee_id1432143id.exe

Full analysis: https://app.any.run/tasks/2bb25991-0858-42db-bf06-b05ab9b11681
Verdict: Malicious activity
Analysis date: April 18, 2024, 05:39:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CC4805556AFBAD7A49B6D2D32770977E

SHA1:

0DC67AA9AABF25BC6920432FFD3F70FCFF532222

SHA256:

DC5FC727D8478BD4069E5FBC75044EF1166140AB5CBBE2CBB41520C66E0646A0

SSDEEP:

98304:Qs09dMO3/N0Kdbgnvr+DpGRoPct/uN7cZzb8m/3uji6eWYw9wNdlk8CyNShgyIfV:dfIxwn1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • PixelSee_id1432143id.exe (PID: 548)

    • Drops the executable file immediately after the start

      • lum_inst.exe (PID: 4000)
      • lum_inst.tmp (PID: 1336)
      • PixelSee_id1432143id.exe (PID: 548)
      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 1816)
      • luminati-m-controller.exe (PID: 3596)
      • luminati-m-controller.exe (PID: 1780)

    • Creates a writable file in the system directory

      • net_updater32.exe (PID: 1816)

    • Changes the autorun value in the registry

      • pixelsee.exe (PID: 2060)

  • SUSPICIOUS

    • Reads the Internet Settings

      • PixelSee_id1432143id.exe (PID: 548)
      • lum_inst.tmp (PID: 1336)
      • luminati-m-controller.exe (PID: 1992)
      • pixelsee.exe (PID: 2060)
      • luminati-m-controller.exe (PID: 3596)
      • pixelsee.exe (PID: 3044)
      • pixelsee.exe (PID: 584)
      • luminati-m-controller.exe (PID: 1780)

    • Process drops legitimate windows executable

      • PixelSee_id1432143id.exe (PID: 548)
      • luminati-m-controller.exe (PID: 1992)

    • Reads Microsoft Outlook installation path

      • PixelSee_id1432143id.exe (PID: 548)

    • Reads security settings of Internet Explorer

      • PixelSee_id1432143id.exe (PID: 548)
      • lum_inst.tmp (PID: 1336)
      • luminati-m-controller.exe (PID: 1992)

    • Reads Internet Explorer settings

      • PixelSee_id1432143id.exe (PID: 548)

    • The process drops C-runtime libraries

      • PixelSee_id1432143id.exe (PID: 548)
      • luminati-m-controller.exe (PID: 1992)

    • Creates a software uninstall entry

      • PixelSee_id1432143id.exe (PID: 548)

    • Executable content was dropped or overwritten

      • PixelSee_id1432143id.exe (PID: 548)
      • lum_inst.exe (PID: 4000)
      • lum_inst.tmp (PID: 1336)
      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 1816)
      • luminati-m-controller.exe (PID: 3596)
      • luminati-m-controller.exe (PID: 1780)

    • Reads the Windows owner or organization settings

      • lum_inst.tmp (PID: 1336)

    • Reads settings of System Certificates

      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 3644)
      • pixelsee.exe (PID: 2060)
      • pixelsee.exe (PID: 3044)
      • pixelsee.exe (PID: 584)

    • Adds/modifies Windows certificates

      • luminati-m-controller.exe (PID: 1992)

    • Detected use of alternative data streams (AltDS)

      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 1816)
      • luminati-m-controller.exe (PID: 3596)
      • luminati-m-controller.exe (PID: 1780)

    • Non-standard symbols in registry

      • lum_inst.tmp (PID: 1336)

    • Executes as Windows Service

      • net_updater32.exe (PID: 1816)

    • Checks Windows Trust Settings

      • net_updater32.exe (PID: 1816)

  • INFO

    • Create files in a temporary directory

      • PixelSee_id1432143id.exe (PID: 548)
      • lum_inst.exe (PID: 4000)

    • Checks supported languages

      • PixelSee_id1432143id.exe (PID: 548)
      • lum_inst.exe (PID: 4000)
      • lum_inst.tmp (PID: 1336)
      • luminati-m-controller.exe (PID: 1992)
      • test_wpf.exe (PID: 3980)
      • net_updater32.exe (PID: 3644)
      • net_updater32.exe (PID: 1816)
      • test_wpf.exe (PID: 2508)
      • idle_report.exe (PID: 1836)
      • brightdata.exe (PID: 2612)
      • pixelsee.exe (PID: 2060)
      • pixelsee_crashpad_handler.exe (PID: 1392)
      • luminati-m-controller.exe (PID: 3596)
      • test_wpf.exe (PID: 2560)
      • pixelsee.exe (PID: 584)
      • pixelsee.exe (PID: 3044)
      • idle_report.exe (PID: 3444)
      • pixelsee_crashpad_handler.exe (PID: 2300)
      • pixelsee_crashpad_handler.exe (PID: 2896)
      • luminati-m-controller.exe (PID: 1780)
      • test_wpf.exe (PID: 316)
      • idle_report.exe (PID: 3668)

    • Reads the computer name

      • PixelSee_id1432143id.exe (PID: 548)
      • lum_inst.tmp (PID: 1336)
      • test_wpf.exe (PID: 3980)
      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 3644)
      • net_updater32.exe (PID: 1816)
      • test_wpf.exe (PID: 2508)
      • brightdata.exe (PID: 2612)
      • idle_report.exe (PID: 1836)
      • pixelsee.exe (PID: 2060)
      • test_wpf.exe (PID: 2560)
      • luminati-m-controller.exe (PID: 3596)
      • pixelsee.exe (PID: 584)
      • pixelsee.exe (PID: 3044)
      • idle_report.exe (PID: 3444)
      • test_wpf.exe (PID: 316)
      • luminati-m-controller.exe (PID: 1780)
      • idle_report.exe (PID: 3668)

    • Checks proxy server information

      • PixelSee_id1432143id.exe (PID: 548)
      • luminati-m-controller.exe (PID: 1992)

    • Creates files or folders in the user directory

      • PixelSee_id1432143id.exe (PID: 548)
      • luminati-m-controller.exe (PID: 1992)
      • pixelsee.exe (PID: 2060)
      • pixelsee_crashpad_handler.exe (PID: 1392)
      • pixelsee.exe (PID: 3044)
      • pixelsee.exe (PID: 584)

    • Reads the machine GUID from the registry

      • PixelSee_id1432143id.exe (PID: 548)
      • luminati-m-controller.exe (PID: 1992)
      • test_wpf.exe (PID: 3980)
      • net_updater32.exe (PID: 3644)
      • net_updater32.exe (PID: 1816)
      • test_wpf.exe (PID: 2508)
      • idle_report.exe (PID: 1836)
      • brightdata.exe (PID: 2612)
      • pixelsee.exe (PID: 2060)
      • luminati-m-controller.exe (PID: 3596)
      • test_wpf.exe (PID: 2560)
      • pixelsee.exe (PID: 3044)
      • pixelsee.exe (PID: 584)
      • idle_report.exe (PID: 3444)
      • luminati-m-controller.exe (PID: 1780)
      • test_wpf.exe (PID: 316)
      • idle_report.exe (PID: 3668)

    • Creates files in the program directory

      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 3644)
      • net_updater32.exe (PID: 1816)
      • brightdata.exe (PID: 2612)
      • luminati-m-controller.exe (PID: 3596)
      • luminati-m-controller.exe (PID: 1780)

    • Reads Environment values

      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 1816)
      • brightdata.exe (PID: 2612)
      • pixelsee.exe (PID: 2060)
      • luminati-m-controller.exe (PID: 3596)
      • pixelsee.exe (PID: 3044)
      • pixelsee.exe (PID: 584)
      • luminati-m-controller.exe (PID: 1780)

    • Process checks computer location settings

      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 1816)
      • luminati-m-controller.exe (PID: 3596)
      • luminati-m-controller.exe (PID: 1780)

    • Reads the software policy settings

      • luminati-m-controller.exe (PID: 1992)
      • net_updater32.exe (PID: 3644)
      • net_updater32.exe (PID: 1816)
      • pixelsee.exe (PID: 2060)
      • pixelsee.exe (PID: 584)

    • Manual execution by a user

      • pixelsee.exe (PID: 584)
      • pixelsee.exe (PID: 3044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:29 17:25:35+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 2723328
InitializedDataSize: 2256896
UninitializedDataSize: -
EntryPoint: 0x263f3f
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 13.0.0.0
ProductVersionNumber: 13.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: PixelSee Player Installer
CompanyName: SIA Circle Solutions
FileDescription: PixelSee Player Installer
FileVersion: 13.0.0.0
InternalName: pixelsee
LegalCopyright: Copyright © 2022-2023 SIA Circle Solutions
OriginalFileName: pixelsee
PrivateBuild: -
ProductName: PixelSee
ProductVersion: 13.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
23
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pixelsee_id1432143id.exe lum_inst.exe lum_inst.tmp luminati-m-controller.exe test_wpf.exe no specs net_updater32.exe net_updater32.exe test_wpf.exe no specs idle_report.exe no specs brightdata.exe no specs pixelsee.exe pixelsee_crashpad_handler.exe no specs luminati-m-controller.exe test_wpf.exe no specs pixelsee.exe pixelsee.exe pixelsee_crashpad_handler.exe no specs pixelsee_crashpad_handler.exe no specs idle_report.exe no specs luminati-m-controller.exe test_wpf.exe no specs idle_report.exe no specs pixelsee_id1432143id.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316C:\ProgramData\BrightData\b85f5ef603041f1fc4e7f943c177a0d440a01266\test_wpf.exeC:\ProgramData\BrightData\b85f5ef603041f1fc4e7f943c177a0d440a01266\test_wpf.exe—luminati-m-controller.exe
User:
admin
Company:
BrightData Ltd. (certified)
Integrity Level:
MEDIUM
Description:
test_wpf
Exit code:
0
Version:
1.435.904
Modules
Images
c:\programdata\brightdata\b85f5ef603041f1fc4e7f943c177a0d440a01266\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
548"C:\Users\admin\AppData\Local\Temp\PixelSee_id1432143id.exe" C:\Users\admin\AppData\Local\Temp\PixelSee_id1432143id.exe
explorer.exe
User:
admin
Company:
SIA Circle Solutions
Integrity Level:
HIGH
Description:
PixelSee Player Installer
Exit code:
0
Version:
13.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pixelsee_id1432143id.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
584"C:\Users\admin\PixelSee\pixelsee.exe" C:\Users\admin\PixelSee\pixelsee.exe
explorer.exe
User:
admin
Company:
SIA Circle Solutions
Integrity Level:
MEDIUM
Description:
PixelSee Player
Exit code:
0
Version:
14.0.0.0
Modules
Images
c:\users\admin\pixelsee\pixelsee.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\pixelsee\sentry.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\advapi32.dll
1196"C:\Users\admin\AppData\Local\Temp\PixelSee_id1432143id.exe" C:\Users\admin\AppData\Local\Temp\PixelSee_id1432143id.exe—explorer.exe
User:
admin
Company:
SIA Circle Solutions
Integrity Level:
MEDIUM
Description:
PixelSee Player Installer
Exit code:
3221226540
Version:
13.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pixelsee_id1432143id.exe
c:\windows\system32\ntdll.dll
1336"C:\Users\admin\AppData\Local\Temp\is-90HRT.tmp\lum_inst.tmp" /SL5="$1C018A,5681168,832512,C:\Users\admin\AppData\Local\Temp\luminati\lum_inst.exe" /verysilentC:\Users\admin\AppData\Local\Temp\is-90HRT.tmp\lum_inst.tmp
lum_inst.exe
User:
admin
Company:
luminati
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
101
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-90hrt.tmp\lum_inst.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1392C:\Users\admin\PixelSee\pixelsee_crashpad_handler.exe --no-rate-limit "--database=C:\Users\admin\AppData\Local\PixelSee LLC\PixelSee\crashdumps" "--metrics-dir=C:\Users\admin\AppData\Local\PixelSee LLC\PixelSee\crashdumps" --url=https://o612922.ingest.sentry.io:443/api/6420364/minidump/?sentry_client=sentry.native/0.4.6&sentry_key=297ce3230e5f4bcf957dbf23e9597dc9 "--attachment=C:/Users/admin/AppData/Local/PixelSee LLC/PixelSee/crashdumps/logs/log" "--attachment=C:\Users\admin\AppData\Local\PixelSee LLC\PixelSee\crashdumps\c1dd5672-5d31-403c-da5e-0b49609636b9.run\__sentry-event" "--attachment=C:\Users\admin\AppData\Local\PixelSee LLC\PixelSee\crashdumps\c1dd5672-5d31-403c-da5e-0b49609636b9.run\__sentry-breadcrumb1" "--attachment=C:\Users\admin\AppData\Local\PixelSee LLC\PixelSee\crashdumps\c1dd5672-5d31-403c-da5e-0b49609636b9.run\__sentry-breadcrumb2" --initial-client-data=0x390,0x394,0x398,0x364,0x39c,0x6b7b7b7c,0x6b7b7b90,0x6b7b7ba0C:\Users\admin\PixelSee\pixelsee_crashpad_handler.exe—pixelsee.exe
User:
admin
Company:
SIA Circle Solutions
Integrity Level:
HIGH
Description:
PixelSee Crash Handler
Exit code:
0
Version:
12.0.0.0
Modules
Images
c:\users\admin\pixelsee\pixelsee_crashpad_handler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
1780C:\Users\admin\PixelSee\Luminati-m\luminati-m-controller.exe is_switch_onC:\Users\admin\PixelSee\Luminati-m\luminati-m-controller.exe
pixelsee.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
101
Modules
Images
c:\users\admin\pixelsee\luminati-m\luminati-m-controller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\pixelsee\luminati-m\lum_sdk32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1816"C:/Users/admin/PixelSee/Luminati-m/net_updater32.exe" --updater win_pixelsee.appC:\Users\admin\PixelSee\Luminati-m\net_updater32.exe
services.exe
User:
SYSTEM
Company:
BrightData Ltd. (certified)
Integrity Level:
SYSTEM
Description:
BrightData service allows free use of certain features in an app you installed
Version:
1.435.904
Modules
Images
c:\users\admin\pixelsee\luminati-m\net_updater32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1836C:\ProgramData\BrightData\b85f5ef603041f1fc4e7f943c177a0d440a01266\idle_report.exe --id 68776 --screenC:\ProgramData\BrightData\b85f5ef603041f1fc4e7f943c177a0d440a01266\idle_report.exe—net_updater32.exe
User:
admin
Company:
BrightData Ltd.
Integrity Level:
MEDIUM
Description:
idle_report
Exit code:
0
Version:
1.435.904
Modules
Images
c:\programdata\brightdata\b85f5ef603041f1fc4e7f943c177a0d440a01266\idle_report.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1992"C:\Users\admin\PixelSee\Luminati-m\luminati-m-controller.exe" switch_onC:\Users\admin\PixelSee\Luminati-m\luminati-m-controller.exe
lum_inst.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
101
Modules
Images
c:\users\admin\pixelsee\luminati-m\luminati-m-controller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\pixelsee\luminati-m\lum_sdk32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
Total events
67 381
Read events
66 445
Write events
826
Delete events
110

Modification events

(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\PixelSee LLC\PixelSee-systemScope\pixelsee_info
Operation:writeName:hasDownloadedUpdate
Value:
false
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PixelSee
Operation:writeName:InstallLocation
Value:
C:\Users\admin\PixelSee\
(PID) Process:(548) PixelSee_id1432143id.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PixelSee
Operation:writeName:DisplayName
Value:
PixelSee
Executable files
466
Suspicious files
73
Text files
152
Unknown types
103

Dropped files

PID
Process
Filename
Type
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\main-icon-big.pngimage
MD5:0E5FEA82CC4F4A8225532E5B2F45C6C8
SHA256:81B5F50491579127D13E050847EF6D817265AB4B70D2796FB74021463B778BB9
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\preloader.htmlhtml
MD5:37A05031BEC9D3E093388407848AF66F
SHA256:CF38F4F8663028BEFF3A7650A9D426B4116891E8547029B66B8D2A13FAD63A48
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\Montserrat-Regular.eotbinary
MD5:2DD0A1DE870AF34D48D43B7CAD82B8D9
SHA256:057BC6C47C47AACCDF31ADC48A6B401F6090A02C28E354099EFF80907DC2AF32
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\bundles\bundle-av360-close.htmlhtml
MD5:E2C2ADAB52558C6D87CB695136B6DA9B
SHA256:595DFB13A2DBA9EB4EEA028229872250BF0EF71921DAF1A131EC6EE87873B348
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\bundles\bundle-av360.htmlhtml
MD5:268227D0A1BF96E114F255E44A500D35
SHA256:4936FF92B62D2283E3ED92C9659AAF25A326122063A3B6E71689D6705B4EDBE2
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\bundles\bundle-coc.htmlhtml
MD5:9C040C5F4DB773934730C0471363B4A4
SHA256:794AA2B7DCC14CF1A7017A9568AB47A81DA2F2D81CE6DE5BB777EDAE21AEF189
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\bundles\bundle-av360-friendly.htmlhtml
MD5:78FE9561DBF23AE4B27526FF4F6D8865
SHA256:96827E81C166999123E62652F8C11C8CC0A436DC29FD1BD845FCFE28E7CBE25E
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\bundles\bundle-av360-friendly2.htmlhtml
MD5:014F4C4869AF313B8F8BB290159FAE98
SHA256:A30468AA5B946FF0A3956B787440A711143B786DE4139D97BF2866A20FD2CA4F
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\curl-ca-bundle.crttext
MD5:BE2B0736EA029FFF398559FA7DF4E646
SHA256:C05A79296D61E3B2A2EBAF5AF476839B976D69A5ACB6F581A667E60E681049A2
548PixelSee_id1432143id.exeC:\Users\admin\AppData\Local\Temp\pixelsee-installer-tmp\bundles\bundle-bdvpn.htmlhtml
MD5:ADF3D2E017E1E77DF13D44575EE1B5A0
SHA256:5866023302614394CA9FDBE63A6B4C55968EA88507C0C0E35494DF7AD9CB8284
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
66
DNS requests
11
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1816
net_updater32.exe
GET
304
178.79.238.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?be7cbf960e83df48
unknown
—
—
unknown
1816
net_updater32.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
unknown
1816
net_updater32.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAdTF0YC22Gdh8cnyPwWxE0%3D
unknown
—
—
unknown
1816
net_updater32.exe
GET
301
3.94.40.55:80
http://http-test1.brdtnet.com/connection/http-test1.html
unknown
—
—
unknown
1816
net_updater32.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
548
PixelSee_id1432143id.exe
51.158.130.233:443
pixelsee.app
Online S.a.s.
FR
unknown
1992
luminati-m-controller.exe
159.223.133.120:443
perr.lum-sdk.io
DIGITALOCEAN-ASN
US
unknown
1992
luminati-m-controller.exe
192.81.214.145:443
perr.lum-sdk.io
DIGITALOCEAN-ASN
US
unknown
1992
luminati-m-controller.exe
3.228.36.186:443
—
AMAZON-AES
US
unknown
1992
luminati-m-controller.exe
161.35.48.195:443
perr.lum-sdk.io
DIGITALOCEAN-ASN
US
unknown
1992
luminati-m-controller.exe
206.189.231.23:443
perr.lum-sdk.io
DIGITALOCEAN-ASN
US
unknown

DNS requests

Domain
IP
Reputation
pixelsee.app
  • 51.158.130.233
unknown
perr.lum-sdk.io
  • 159.223.133.120
  • 192.81.214.145
  • 161.35.48.195
  • 206.189.231.23
unknown
perr.l-err.biz
  • 161.35.48.195
  • 159.223.133.120
  • 206.189.231.23
  • 192.81.214.145
unknown
ctldl.windowsupdate.com
  • 178.79.238.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.dropbox.com
  • 162.125.66.18
shared
uc25807cbfb384f4830325c6f1f8.dl.dropboxusercontent.com
  • 162.125.66.15
unknown
help.brightdata.com
  • 104.18.25.60
  • 104.18.24.60
unknown
brightdata.zendesk.com
  • 104.16.51.111
  • 104.16.53.111
unknown
www.google-analytics.com
  • 142.250.181.238
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1816
net_updater32.exe
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
Process
Message
pixelsee.exe
QWindowsEGLStaticContext::create: Could not initialize EGL display: error 0x3001
pixelsee.exe
QWindowsEGLStaticContext::create: When using ANGLE, check if d3dcompiler_4x.dll is available
pixelsee.exe
> __thiscall Application::Application(int &,char *[])
pixelsee.exe
os version: "6.1.7601v" __ os name: "Windows 7 Version 6.1 (Build 7601: SP 1)"
pixelsee.exe
> int __thiscall Application::exec(void)
pixelsee.exe
> __thiscall PixelseeSettings::PixelseeSettings(void)
pixelsee.exe
INSTALL ID: "" _ OLD ID: ""
pixelsee.exe
reseller - "" installId ""
pixelsee.exe
> void __thiscall PixelseeSettings::flushSettings(void)
pixelsee.exe
main libvlc debug: revision 3.0.16-0-g5e70837d8d
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PixelSee_id1432143id.exe