download:

/installer/63950252086695844364/6111090

Full analysis: https://app.any.run/tasks/91246e27-e519-403b-8a5c-9cbb9ddb6812
Verdict: Malicious activity
Analysis date: July 08, 2024, 07:09:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
netreactor
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

609FEA742D34DC1D53F0EEB4873B1A0A

SHA1:

3232C52DA3CB8F47A870162A35CDD75FCAE60AEA

SHA256:

E2E15826B69778E381F25AC8F2B109A377B23F7CF79B5F482E81F4D28C30F95E

SSDEEP:

98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 6111090.exe (PID: 1228)
      • 6111090.exe (PID: 6176)
      • 6111090.tmp (PID: 6464)
      • CheatEngine75.exe (PID: 5840)
      • prod0.exe (PID: 2652)
      • UnifiedStub-installer.exe (PID: 6616)
      • awyihqxo.exe (PID: 3584)
      • CheatEngine75.tmp (PID: 2360)

    • Starts NET.EXE for service management

      • net.exe (PID: 2336)
      • CheatEngine75.tmp (PID: 2360)
      • net.exe (PID: 3676)

    • Actions looks like stealing of personal data

      • UnifiedStub-installer.exe (PID: 6616)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 6111090.tmp (PID: 5396)
      • 6111090.tmp (PID: 6464)
      • prod0.exe (PID: 2652)
      • Cheat Engine.exe (PID: 5532)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Executable content was dropped or overwritten

      • 6111090.exe (PID: 6176)
      • 6111090.exe (PID: 1228)
      • 6111090.tmp (PID: 6464)
      • CheatEngine75.exe (PID: 5840)
      • CheatEngine75.tmp (PID: 2360)
      • prod0.exe (PID: 2652)
      • awyihqxo.exe (PID: 3584)
      • UnifiedStub-installer.exe (PID: 6616)

    • Reads the date of Windows installation

      • 6111090.tmp (PID: 5396)
      • 6111090.tmp (PID: 6464)
      • prod0.exe (PID: 2652)
      • Cheat Engine.exe (PID: 5532)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Reads the Windows owner or organization settings

      • 6111090.tmp (PID: 6464)
      • CheatEngine75.tmp (PID: 2360)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 2360)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 2360)

    • Process drops legitimate windows executable

      • awyihqxo.exe (PID: 3584)
      • CheatEngine75.tmp (PID: 2360)
      • UnifiedStub-installer.exe (PID: 6616)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 2360)

    • Creates a software uninstall entry

      • UnifiedStub-installer.exe (PID: 6616)

    • Searches for installed software

      • UnifiedStub-installer.exe (PID: 6616)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 5504)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Checks Windows Trust Settings

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Creates file in the systems drive root

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • There is functionality for communication over UDP network (YARA)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

  • INFO

    • Create files in a temporary directory

      • 6111090.exe (PID: 1228)
      • 6111090.exe (PID: 6176)
      • 6111090.tmp (PID: 6464)
      • CheatEngine75.exe (PID: 5840)
      • CheatEngine75.tmp (PID: 2360)
      • prod0.exe (PID: 2652)
      • awyihqxo.exe (PID: 3584)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)
      • UnifiedStub-installer.exe (PID: 6616)

    • Checks supported languages

      • 6111090.exe (PID: 1228)
      • 6111090.tmp (PID: 5396)
      • 6111090.exe (PID: 6176)
      • 6111090.tmp (PID: 6464)
      • CheatEngine75.tmp (PID: 2360)
      • CheatEngine75.exe (PID: 5840)
      • prod0.exe (PID: 2652)
      • _setup64.tmp (PID: 5876)
      • awyihqxo.exe (PID: 3584)
      • rsSyncSvc.exe (PID: 1068)
      • UnifiedStub-installer.exe (PID: 6616)
      • Kernelmoduleunloader.exe (PID: 5132)
      • Cheat Engine.exe (PID: 5532)
      • windowsrepair.exe (PID: 1192)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)
      • rsSyncSvc.exe (PID: 5504)
      • Tutorial-x86_64.exe (PID: 6912)

    • Reads the computer name

      • 6111090.tmp (PID: 5396)
      • 6111090.tmp (PID: 6464)
      • CheatEngine75.tmp (PID: 2360)
      • prod0.exe (PID: 2652)
      • rsSyncSvc.exe (PID: 1068)
      • rsSyncSvc.exe (PID: 5504)
      • UnifiedStub-installer.exe (PID: 6616)
      • Kernelmoduleunloader.exe (PID: 5132)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)
      • Cheat Engine.exe (PID: 5532)
      • Tutorial-x86_64.exe (PID: 6912)

    • Process checks computer location settings

      • 6111090.tmp (PID: 5396)
      • 6111090.tmp (PID: 6464)
      • prod0.exe (PID: 2652)
      • Cheat Engine.exe (PID: 5532)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Reads the machine GUID from the registry

      • 6111090.tmp (PID: 6464)
      • prod0.exe (PID: 2652)
      • UnifiedStub-installer.exe (PID: 6616)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Checks proxy server information

      • 6111090.tmp (PID: 6464)
      • prod0.exe (PID: 2652)
      • UnifiedStub-installer.exe (PID: 6616)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)
      • slui.exe (PID: 6324)

    • Reads the software policy settings

      • 6111090.tmp (PID: 6464)
      • prod0.exe (PID: 2652)
      • UnifiedStub-installer.exe (PID: 6616)
      • slui.exe (PID: 1920)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)
      • slui.exe (PID: 6324)

    • Disables trace logs

      • prod0.exe (PID: 2652)
      • UnifiedStub-installer.exe (PID: 6616)

    • Reads Environment values

      • prod0.exe (PID: 2652)
      • UnifiedStub-installer.exe (PID: 6616)

    • Creates files in the program directory

      • CheatEngine75.tmp (PID: 2360)
      • UnifiedStub-installer.exe (PID: 6616)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • Creates a software uninstall entry

      • CheatEngine75.tmp (PID: 2360)

    • Creates files or folders in the user directory

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5652)

    • .NET Reactor protector has been detected

      • UnifiedStub-installer.exe (PID: 6616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.0
ProductVersionNumber: 7.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: EngineGame Installer
FileVersion: 7.5.0
LegalCopyright: © EngineGame
OriginalFileName:
ProductName: EngineGame
ProductVersion: 7.5.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
36
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 6111090.exe 6111090.tmp no specs 6111090.exe 6111090.tmp sppextcomobj.exe no specs slui.exe prod0.exe cheatengine75.exe cheatengine75.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs awyihqxo.exe THREAT unifiedstub-installer.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs THREAT cheatengine-x86_64-sse4-avx2.exe slui.exe tutorial-x86_64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1064\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe—UnifiedStub-installer.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
Reason Security Synchronize Service
Exit code:
0
Version:
1.7.2.0
Modules
Images
c:\program files\reasonlabs\common\rssyncsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1192"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /sC:\Program Files\Cheat Engine 7.5\windowsrepair.exe—CheatEngine75.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine 7.5\windowsrepair.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Users\admin\AppData\Local\Temp\6111090.exe" C:\Users\admin\AppData\Local\Temp\6111090.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
EngineGame Installer
Exit code:
0
Version:
7.5.0
Modules
Images
c:\users\admin\appdata\local\temp\6111090.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—_setup64.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1920"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2336"net" stop BadlionAnticC:\Windows\System32\net.exe—CheatEngine75.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
Total events
25 754
Read events
25 566
Write events
156
Delete events
32

Modification events

(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
40190000844EBFD705D1DA01
(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
1A285904A22DD0E5A68CF9E92FD547033648DB59123899C67BC2CDB35494111F
(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6464) 6111090.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2652) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2652) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2652) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
195
Suspicious files
116
Text files
415
Unknown types
13

Dropped files

PID
Process
Filename
Type
12286111090.exeC:\Users\admin\AppData\Local\Temp\is-IUFJ5.tmp\6111090.tmpexecutable
MD5:1CDBF6DA4DEFE32C9CB5908968A02FAB
SHA256:87C1BB2236A874C97369B2CCA0D55559FA917707CEBDDF7A5EABC691F8302487
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\logo.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\is-2UEA5.tmpexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\RAV_Cross.pngimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
61766111090.exeC:\Users\admin\AppData\Local\Temp\is-0OONT.tmp\6111090.tmpexecutable
MD5:1CDBF6DA4DEFE32C9CB5908968A02FAB
SHA256:87C1BB2236A874C97369B2CCA0D55559FA917707CEBDDF7A5EABC691F8302487
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\CheatEngine75.exeexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\finish.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\error.pngimage
MD5:6B7CB2A5A8B301C788C3792802696FE8
SHA256:3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
64646111090.tmpC:\Users\admin\AppData\Local\Temp\is-RC612.tmp\prod0executable
MD5:666A6BC30391C779EFA182EDFF0CD2B0
SHA256:CF33FB9C6F049B4071E49608F1B29B88067ABBDB34D9ED56BA5ED647EE4AF7E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
83
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2072
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
3656
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2072
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
7136
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
7136
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6332
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6324
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
5652
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
69.192.161.44:80
http://x2.c.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2072
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2248
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2340
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3656
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
52.111.236.21:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3656
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.31.67
  • 20.190.159.0
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.23
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
d2oq4dwfbh6gxl.cloudfront.net
  • 18.66.137.198
  • 18.66.137.114
  • 18.66.137.70
  • 18.66.137.45
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.bing.com
  • 92.123.104.21
  • 92.123.104.19
  • 92.123.104.17
  • 92.123.104.16
  • 92.123.104.5
  • 92.123.104.14
  • 92.123.104.18
  • 92.123.104.20
  • 92.123.104.9
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
Process
Message
Kernelmoduleunloader.exe
Kernelmodule unloader
Kernelmoduleunloader.exe
Running in wow64
Kernelmoduleunloader.exe
Setup. So do not show messages
Kernelmoduleunloader.exe
attempting to unload
Kernelmoduleunloader.exe
SCManager opened
Kernelmoduleunloader.exe
count=0
Kernelmoduleunloader.exe
setup=true
cheatengine-x86_64-SSE4-AVX2.exe
Lua thread terminated
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/installer/63950252086695844364/6111090