File name:

installer.exe

Full analysis: https://app.any.run/tasks/5de0f0f7-bd8e-4a7f-9f24-dbb290091094
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 02:44:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
sainbox
rat
auto-reg
auto-startup
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

465607A35CEC7B0046A9EAF611E6FAE7

SHA1:

8A874B245CC1A8C42675DBA42B6CA76186078C4B

SHA256:

E3602A950F21A3ECDC2C9CB34D866D32CF1C71D17B6A80963F16B34B48FB5497

SSDEEP:

6144:nNTZUvA+AIXLAEzRTXp+ylYYQx3zFppMUdW/sev:NUA+nXLAEdLpJWmnsev

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • Qa_oYTG.exe (PID: 7432)

    • Changes Security Center notification settings

      • Qa_oYTG.exe (PID: 7432)

    • SAINBOX has been detected

      • Qa_oYTG.exe (PID: 7432)

    • SALITY mutex has been found

      • EUaVtjy.exe (PID: 7452)
      • rpLWaWv.exe (PID: 7532)
      • Qa_oYTG.exe (PID: 7432)
      • operagxtmp.exe (PID: 7944)
      • iexplore.exe (PID: 7520)
      • iexplore.exe (PID: 7708)
      • ielowutil.exe (PID: 7952)
      • operagxtmp.exe (PID: 3332)

    • Create files in the Startup directory

      • rpLWaWv.exe (PID: 7532)

    • Changes the autorun value in the registry

      • rpLWaWv.exe (PID: 7532)
      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

  • SUSPICIOUS

    • The process executes VB scripts

      • installer.exe (PID: 7348)

    • Reads the date of Windows installation

      • installer.exe (PID: 7348)
      • dw20.exe (PID: 7860)

    • Executable content was dropped or overwritten

      • installer.exe (PID: 7348)
      • rpLWaWv.exe (PID: 7532)
      • Qa_oYTG.exe (PID: 7432)

    • Executes application which crashes

      • oFdqktG.exe (PID: 7468)

    • Creates file in the systems drive root

      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 7984)
      • iexplore.exe (PID: 7440)
      • iexplore.exe (PID: 2516)
      • iexplore.exe (PID: 3100)
      • iexplore.exe (PID: 7392)
      • iexplore.exe (PID: 1760)
      • iexplore.exe (PID: 5680)
      • iexplore.exe (PID: 3268)
      • iexplore.exe (PID: 2148)

    • Connects to unusual port

      • rpLWaWv.exe (PID: 7532)
      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

    • Reads security settings of Internet Explorer

      • installer.exe (PID: 7348)
      • Qa_oYTG.exe (PID: 7432)

    • Process drops legitimate windows executable

      • Qa_oYTG.exe (PID: 7432)

  • INFO

    • Reads Microsoft Office registry keys

      • installer.exe (PID: 7348)

    • Reads the computer name

      • installer.exe (PID: 7348)
      • oFdqktG.exe (PID: 7468)
      • Qa_oYTG.exe (PID: 7432)
      • rpLWaWv.exe (PID: 7532)
      • dw20.exe (PID: 7860)
      • iL_ZcXC.exe (PID: 7500)
      • ielowutil.exe (PID: 7952)
      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

    • The sample compiled with english language support

      • installer.exe (PID: 7348)
      • Qa_oYTG.exe (PID: 7432)

    • Checks supported languages

      • EUaVtjy.exe (PID: 7452)
      • Qa_oYTG.exe (PID: 7432)
      • installer.exe (PID: 7348)
      • oFdqktG.exe (PID: 7468)
      • rpLWaWv.exe (PID: 7532)
      • iL_ZcXC.exe (PID: 7500)
      • dw20.exe (PID: 7860)
      • ielowutil.exe (PID: 7952)
      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

    • Process checks computer location settings

      • installer.exe (PID: 7348)
      • dw20.exe (PID: 7860)

    • Create files in a temporary directory

      • rpLWaWv.exe (PID: 7532)
      • Qa_oYTG.exe (PID: 7432)

    • Creates files or folders in the user directory

      • rpLWaWv.exe (PID: 7532)
      • WerFault.exe (PID: 7736)
      • Qa_oYTG.exe (PID: 7432)

    • Checks proxy server information

      • Qa_oYTG.exe (PID: 7432)
      • dw20.exe (PID: 7860)

    • Reads the machine GUID from the registry

      • dw20.exe (PID: 7860)
      • rpLWaWv.exe (PID: 7532)
      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

    • Reads product name

      • dw20.exe (PID: 7860)

    • Auto-launch of the file from Startup directory

      • rpLWaWv.exe (PID: 7532)

    • Reads Environment values

      • dw20.exe (PID: 7860)

    • Creates files in the program directory

      • dw20.exe (PID: 7860)

    • Reads CPU info

      • dw20.exe (PID: 7860)

    • Reads the software policy settings

      • dw20.exe (PID: 7860)

    • Auto-launch of the file from Registry key

      • rpLWaWv.exe (PID: 7532)
      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

    • Manual execution by a user

      • operagxtmp.exe (PID: 3332)
      • operagxtmp.exe (PID: 7944)

    • UPX packer has been detected

      • Qa_oYTG.exe (PID: 7432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (32.2)
.exe | Generic CIL Executable (.NET, Mono, etc.) (28.8)
.exe | InstallShield setup (16.9)
.exe | Win64 Executable (generic) (10.8)
.scr | Windows screen saver (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:18 02:22:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 281088
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x468fe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: installer.exe
LegalCopyright:
OriginalFileName: installer.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
302
Monitored processes
174
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start installer.exe wscript.exe no specs #SALITY qa_oytg.exe #SALITY euavtjy.exe ofdqktg.exe il_zcxc.exe no specs #SALITY rplwawv.exe werfault.exe no specs dw20.exe #SALITY ielowutil.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs #SALITY operagxtmp.exe iexplore.exe no specs #SALITY iexplore.exe no specs #SALITY iexplore.exe no specs #SALITY operagxtmp.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs slui.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
672"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
776"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
904"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
920"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5512 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
960"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1040"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7392 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1052"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3100 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1072"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7048 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1072"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3176 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
162 745
Read events
161 502
Write events
1 084
Delete events
159

Modification events

(PID) Process:(7348) installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(7432) Qa_oYTG.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:FirewallDisableNotify
Value:
1
Executable files
9
Suspicious files
319
Text files
3
Unknown types
5

Dropped files

PID
Process
Filename
Type
7736WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oFdqktG.exe_ede66c5e4e296ffcc7061b7a78814b8db1ff55_1dbdf201_23eb89ac-9116-4d9b-beef-387e15121127\Report.wer —
MD5:—
SHA256:—
7736WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\oFdqktG.exe.7468.dmp —
MD5:—
SHA256:—
7860dw20.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_euavtjy.exe_cee877e3f727384ce262720619b087aeda85fb_00000000_7bd3ed52-b8a6-4276-89f7-f721d3fc6d10\Report.wer —
MD5:—
SHA256:—
7532rpLWaWv.exeC:\Users\admin\AppData\Local\Temp\Microsoft\operagxtmp.exeexecutable
MD5:ECB4A02B6E9E373279F8D1E50C7DD3FD
SHA256:BDF0C0B5CD2B4EB479BE878CBA963CE84AC3FD6DEBB4D238E3641ABF0FE768A5
7348installer.exeC:\Users\admin\Music\Qa_oYTG.exeexecutable
MD5:AA38DCD588CF86A02EA3C8FAAE039F45
SHA256:3B7FF0D15BD4A55B0558EB5CC3387889918AE3DE886634D6286FB7EBA77F5B94
7348installer.exeC:\Users\admin\Music\BPEbOkD.vbsbinary
MD5:EEECE8A57283FB7085EB9E9941B0FC1B
SHA256:C9248D9662E4B366F5BB4232979C34209913F914514933A0CBD351AC4167AFAD
7348installer.exeC:\Users\admin\Music\EUaVtjy.exeexecutable
MD5:3003CA8BBDDE3B4E9ECF6C78771751BE
SHA256:0895E5C8354D90CD47DFD9B0F92D400BA0675E2467F01D6D4714344345AFE931
7736WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC371.tmp.dmpbinary
MD5:5BED678B1CF0F5BD898BA989627D0C59
SHA256:B10D6CAC1D22EDF25E8CF330134A45A665BE72C51417CC30053A4DFDA92891BC
7736WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC5B4.tmp.WERInternalMetadata.xmlbinary
MD5:B2E7E555992588A16CE9CB026E78F846
SHA256:650BFF96FC7F6F61FADC233EDC7A735EDBC51FE43CF0EFA8A9820A2120419828
7532rpLWaWv.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\operagxtmp.exeexecutable
MD5:ECB4A02B6E9E373279F8D1E50C7DD3FD
SHA256:BDF0C0B5CD2B4EB479BE878CBA963CE84AC3FD6DEBB4D238E3641ABF0FE768A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
25
DNS requests
8
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2656
RUXIMICS.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2656
RUXIMICS.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7532
rpLWaWv.exe
66.113.31.17:7547
—
STRATUSIQ
US
malicious
7860
dw20.exe
20.189.173.20:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2656
RUXIMICS.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2656
RUXIMICS.exe
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.46
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.20
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7532
rpLWaWv.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
3332
operagxtmp.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
7944
operagxtmp.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
installer.exe