File name:

OpenShellSetup_4_4_195.exe

Full analysis: https://app.any.run/tasks/1aed91f1-e102-4cbd-b78e-c67eafc203ca
Verdict: Malicious activity
Analysis date: February 13, 2025, 00:40:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xor-url
generic
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

FEB30D464607626F3EB3FAF91CAD2D82

SHA1:

93FC9FABFF60AF8F357AB2E7EE58562E02A5DF45

SHA256:

DC79E3ABEBD128D7F44FA8F03A4E660B5F60B011F7BCF374B35C18A741F5818A

SSDEEP:

98304:dyu3a7BC7fGnWqboMC68WsaI33Bjxug50/FK2PtIxVIuRLNV+QOUiZPG48ZRKHWa:7U+aNBFZMlJkE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XORed URL has been found (YARA)

      • OpenShellSetup_4_4_195.exe (PID: 6240)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 6300)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6820)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6300)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 4132)
      • msiexec.exe (PID: 1480)
      • msiexec.exe (PID: 3848)
      • msiexec.exe (PID: 6084)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 6300)
      • OpenShellSetup_4_4_195.exe (PID: 6240)
      • StartMenu.exe (PID: 3876)

    • The sample compiled with english language support

      • OpenShellSetup_4_4_195.exe (PID: 6240)
      • msiexec.exe (PID: 6300)

    • Reads the computer name

      • msiexec.exe (PID: 6300)
      • StartMenu.exe (PID: 3876)

    • Creates files in the program directory

      • OpenShellSetup_4_4_195.exe (PID: 6240)

    • Manages system restore points

      • SrTasks.exe (PID: 7104)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6300)

    • Application launched itself

      • msiexec.exe (PID: 6300)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6300)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)

    • Local mutex for internet shortcut management

      • explorer.exe (PID: 4488)

    • Create files in a temporary directory

      • explorer.exe (PID: 4488)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4488)

    • Reads the software policy settings

      • explorer.exe (PID: 4488)

    • Checks proxy server information

      • explorer.exe (PID: 4488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:04 15:35:42+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 79872
InitializedDataSize: 7543808
UninitializedDataSize: -
EntryPoint: 0x2627
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.4.195.0
ProductVersionNumber: 4.4.195.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Open-Shell
FileDescription: Adds classic shell features to Windows 7 and Windows 8
FileVersion: 4.4.195
InternalName: OpenShellSetup
LegalCopyright: Copyright (C) 2017-2018, The Open-Shell Team
OriginalFileName: OpenShellSetup.exe
ProductName: Open-Shell
ProductVersion: 4.4.195
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL openshellsetup_4_4_195.exe no specs msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs startmenu.exe no specs COpenControlPanel no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1480"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer64.dll"C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3848"C:\Windows\syswow64\MsiExec.exe" /Y "C:\WINDOWS\SysWOW64\StartMenuHelper32.dll"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3876"C:\Program Files\Open-Shell\StartMenu.exe"C:\Program Files\Open-Shell\StartMenu.exe—msiexec.exe
User:
admin
Company:
Open-Shell
Integrity Level:
MEDIUM
Description:
Open-Shell Menu
Version:
4.4.195
Modules
Images
c:\program files\open-shell\startmenu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4120C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
4132"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer32.dll"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6084"C:\Windows\System32\MsiExec.exe" /Y "C:\WINDOWS\system32\StartMenuHelper64.dll"C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6240"C:\Users\admin\AppData\Local\Temp\OpenShellSetup_4_4_195.exe" C:\Users\admin\AppData\Local\Temp\OpenShellSetup_4_4_195.exe
explorer.exe
User:
admin
Company:
Open-Shell
Integrity Level:
MEDIUM
Description:
Adds classic shell features to Windows 7 and Windows 8
Exit code:
0
Version:
4.4.195
Modules
Images
c:\users\admin\appdata\local\temp\openshellsetup_4_4_195.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6260msiexec.exe /i "C:\ProgramData\OpenShellSetup64_4_4_195.msi" C:\Windows\SysWOW64\msiexec.exe—OpenShellSetup_4_4_195.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6300C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
10 334
Read events
9 710
Write events
398
Delete events
226

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000080306
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502AA
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001002D2
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502AA
Operation:delete keyName:(default)
Value:
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009007E
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001002D2
Operation:delete keyName:(default)
Value:
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000702AA
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009007E
Operation:delete keyName:(default)
Value:
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000702AA
Operation:delete keyName:(default)
Value:
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A007E
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
Executable files
25
Suspicious files
62
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6240OpenShellSetup_4_4_195.exeC:\ProgramData\OpenShellSetup64_4_4_195.msi —
MD5:—
SHA256:—
6300msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6300msiexec.exeC:\Windows\Installer\13c1fb.msi —
MD5:—
SHA256:—
6300msiexec.exeC:\Program Files\Open-Shell\Skins\Classic Skin.skin7executable
MD5:FAA7CA24C9006EF763C6F457B1DC0DFA
SHA256:7BF49E5A5D9E6E47F89BCFE6381C2E7FF3BAFB004866B8BB9F0DF1A436250742
6300msiexec.exeC:\Program Files\Open-Shell\ClassicExplorer32.dllexecutable
MD5:558609ADB9FE385662C6CD8C7D869829
SHA256:A4E4E14B4C8B652D6793D0AADA0EF9C3274685BE392A6651C08D4FAE39D8A369
6300msiexec.exeC:\Windows\Temp\~DFB5F8398BD27A6EAC.TMPbinary
MD5:938554626AAD6005E11C02BF74728FAF
SHA256:8838EA5D1C006DB7FC34B3D94B9D740206356666ECD58B7F43F53EBDF3BEEC77
6300msiexec.exeC:\Program Files\Open-Shell\Skins\Immersive.skinexecutable
MD5:46FE65CFACF3F046272FEE22EB387F1B
SHA256:62C5330A3C746FEBF3B0D1019EE2AD860A6287C3855D93120E7161DCF327187D
6300msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:4350FF04B072A0586986EAD35B104A5F
SHA256:AB16CB2D26C839DD04630403911AAC0091599091048A5179367B4FFEBAE30DBF
6300msiexec.exeC:\Windows\Temp\~DFB1B5AFEDA1C1F353.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6300msiexec.exeC:\Program Files\Open-Shell\ClassicExplorerSettings.exeexecutable
MD5:63BD2D008A91E7FB95FF1C529A6E59F4
SHA256:992FD6C95C730709B47AF4F8D39F9F5558139603DD0030F7290122EF0DC4D89D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
20
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
2.21.245.180:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.21.245.180:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.21.245.180:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.58.102.107:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.58.102.107:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
23.58.102.107:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4488
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
—
—
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
4488
explorer.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CECoW9cIBGAf3CpJj3Tw5qfI%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
95.100.248.219:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2736
svchost.exe
2.21.245.180:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.21.245.180:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.21.245.180:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.58.102.107:80
www.microsoft.com
AKAMAI-AS
IN
whitelisted
2736
svchost.exe
23.58.102.107:80
www.microsoft.com
AKAMAI-AS
IN
whitelisted
—
—
23.58.102.107:80
www.microsoft.com
AKAMAI-AS
IN
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 95.100.248.219
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 2.21.245.180
whitelisted
www.microsoft.com
  • 23.58.102.107
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OpenShellSetup_4_4_195.exe