File name:

Setup_Viewx64_25.00.00.032.exe

Full analysis: https://app.any.run/tasks/58e09444-aca5-4fe5-b7a3-d1d0bd8d148e
Verdict: Malicious activity
Analysis date: September 03, 2025, 16:26:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-html
anti-evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

3610DB4D351E5A53B71B5BE649A41448

SHA1:

2A4AC42029BE5C0250A726BBDFF33F4595F257D9

SHA256:

E61BCE342972986B6278F435B931E208DDB6E7464A9CDEE9A478F3853FEB516F

SSDEEP:

98304:w1svXJG6gIS6q7xT9BYrmZvuwgivRztT25zn/GQ4sI+EuHdFaUbJZfNiDnHmVthK:89xySUQP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Searches for installed software

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • dllhost.exe (PID: 6876)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • The process creates files with name similar to system file names

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • msiexec.exe (PID: 3788)

    • Reads security settings of Internet Explorer

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)

    • Starts itself from another location

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • VC_redist.x64.exe (PID: 2232)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3948)

    • Creates a software uninstall entry

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Process drops legitimate windows executable

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3788)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3788)

    • Starts a Microsoft application from unusual location

      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 3788)

    • The process checks if it is being run in the virtual environment

      • msiexec.exe (PID: 3788)

    • Application launched itself

      • VC_redist.x64.exe (PID: 6140)
      • VC_redist.x64.exe (PID: 6936)

  • INFO

    • The sample compiled with english language support

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Create files in a temporary directory

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Checks supported languages

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6140)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • msiexec.exe (PID: 1508)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • msiexec.exe (PID: 4544)

    • Reads the machine GUID from the registry

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Reads the computer name

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • msiexec.exe (PID: 1508)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • msiexec.exe (PID: 4544)

    • Reads the software policy settings

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • msiexec.exe (PID: 3788)

    • Process checks computer location settings

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)

    • Disables trace logs

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)

    • Checks proxy server information

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)

    • Manages system restore points

      • SrTasks.exe (PID: 4200)

    • Creates files or folders in the user directory

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)

    • Launching a file from a Registry key

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Creates files in the program directory

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3788)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:22 22:14:43+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 314368
InitializedDataSize: 308736
UninitializedDataSize: -
EntryPoint: 0x302e5
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 25.0.0.32
ProductVersionNumber: 25.0.0.32
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Bentley Systems, Incorporated
FileDescription: Bentley View 2025
FileVersion: 25.0.0.32
InternalName: setup
LegalCopyright: Copyright © 2025 Bentley Systems, Incorporated. All rights reserved.
OriginalFileName: Setup_Viewx64_25.00.00.032.exe
ProductName: Bentley View 2025
ProductVersion: 25.0.0.32
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
25
Malicious processes
13
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
1508C:\Windows\syswow64\MsiExec.exe -Embedding AE5066A658F67028BD57416538C88D53C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1560"C:\Users\admin\AppData\Local\Temp\{BC1F8B03-F027-4AD3-B0D5-6EB7BA9FC47A}\.cr\Setup_Viewx64_25.00.00.032.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\Setup_Viewx64_25.00.00.032.exe" -burn.filehandle.attached=584 -burn.filehandle.self=700 C:\Users\admin\AppData\Local\Temp\{BC1F8B03-F027-4AD3-B0D5-6EB7BA9FC47A}\.cr\Setup_Viewx64_25.00.00.032.exe
Setup_Viewx64_25.00.00.032.exe
User:
admin
Company:
Bentley Systems, Incorporated
Integrity Level:
MEDIUM
Description:
Bentley View 2025
Version:
25.0.0.32
Modules
Images
c:\users\admin\appdata\local\temp\{bc1f8b03-f027-4ad3-b0d5-6eb7ba9fc47a}\.cr\setup_viewx64_25.00.00.032.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1592"C:\ProgramData\Package Cache\38B647D37B42378222856972A1E22FBD8CF4B404\VC_redist.x64.exe" /install /quiet /norestartC:\ProgramData\Package Cache\38B647D37B42378222856972A1E22FBD8CF4B404\VC_redist.x64.exe
Setup_Viewx64_25.00.00.032.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433
Exit code:
3010
Version:
14.42.34433.0
Modules
Images
c:\programdata\package cache\38b647d37b42378222856972a1e22fbd8cf4b404\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1712"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0DC9EC85-D92F-48DF-A553-73AA541F18BB} {62CEE5A9-23ED-4B73-8AB6-A4AC51AB1B43} 6936C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532
Exit code:
0
Version:
14.36.32532.0
Modules
Images
c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2232"C:\WINDOWS\Temp\{A0674FC5-F8B8-4116-B018-CD9F12B5A921}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\38B647D37B42378222856972A1E22FBD8CF4B404\VC_redist.x64.exe" -burn.filehandle.attached=708 -burn.filehandle.self=560 /install /quiet /norestartC:\Windows\Temp\{A0674FC5-F8B8-4116-B018-CD9F12B5A921}\.cr\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433
Exit code:
3010
Version:
14.42.34433.0
Modules
Images
c:\windows\temp\{a0674fc5-f8b8-4116-b018-cd9f12b5a921}\.cr\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2528"C:\WINDOWS\Temp\{41804788-399B-4473-A1B1-B8D0D44F8B33}\.be\AspNetCoreSharedFrameworkBundle-x64.exe" -q -burn.elevated BurnPipe.{AEEF2CDF-0D4F-4419-9927-EB110B6109E2} {FA949C4E-69C2-4729-B438-1DD85B688733} 6320C:\Windows\Temp\{41804788-399B-4473-A1B1-B8D0D44F8B33}\.be\AspNetCoreSharedFrameworkBundle-x64.exe
aspnetcore-runtime-8.0.11-win-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ASP.NET Core 8.0.11 - Shared Framework (x64)
Exit code:
0
Version:
8.0.11.24521
Modules
Images
c:\windows\temp\{41804788-399b-4473-a1b1-b8d0d44f8b33}\.be\aspnetcoresharedframeworkbundle-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3288"C:\WINDOWS\Temp\{43C33E42-AC1E-407F-A58D-585C71A1AA0D}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{2DFC76F9-6C43-4751-973D-ABA675EBE418} {8BD12DA5-ABB3-4A40-8F4C-7B880A4BF849} 4216C:\Windows\Temp\{43C33E42-AC1E-407F-A58D-585C71A1AA0D}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
windowsdesktop-runtime-8.0.11-win-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Desktop Runtime - 8.0.11 (x64)
Version:
8.0.11.34221
Modules
Images
c:\windows\temp\{43c33e42-ac1e-407f-a58d-585c71a1aa0d}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3788C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3948C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4024C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
22 384
Read events
20 367
Write events
1 600
Delete events
417

Modification events

(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
322
Suspicious files
132
Text files
145
Unknown types
0

Dropped files

PID
Process
Filename
Type
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\ObjectEnablerLookUpExtension.beext.dllexecutable
MD5:26C195C53DC350D1248D314337E866D5
SHA256:4075434B30A93B5481F2E1CB5B9244509A111EEC717B25D5FCC260BF88A7AFBD
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\BootstrapperCore.dllexecutable
MD5:E808F606E54D6F823B9D22F56E8982FC
SHA256:CF2AE76D1DA5AF70A72259E7E51DAE62C715BC32239DAF5DA6B1BDE122BCDAB6
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\mbahost.dllexecutable
MD5:E3471734DF4345B4EC9F60333A96982B
SHA256:D728E7449243BC7099890BADB6FAE3F2B082A80D9C950E498051F89A65D48687
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\1028\mbapreq.wxlxml
MD5:1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA256:1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
6492Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{BC1F8B03-F027-4AD3-B0D5-6EB7BA9FC47A}\.cr\Setup_Viewx64_25.00.00.032.exeexecutable
MD5:A71DEE8546111E412C34E3E73D590429
SHA256:D714A840D8ECD46D23092E6A531E4CD2791C1623E6488A3BA84158ADAD69593D
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\1041\mbapreq.wxlxml
MD5:DB0F5BAB42403FD67C0A18E35E6880EC
SHA256:CCDCDB111EFA152C5F9FF4930033698B843390A549699AE802098D87431F16FE
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\SetupPagesLib.dllexecutable
MD5:F22A30EB9EEC8E25C64D76FE8ECFEFCD
SHA256:092F766D6E1B731E4CF4B763234AA7D1C039D4A5BAD0E67C18C0EE3E3E5AA76F
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\1060\mbapreq.wxlxml
MD5:5836F0C655BDD97093F68AAF69AB2BAB
SHA256:C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\WixInstallBA.dllexecutable
MD5:9B231188A8A7029B93203A78A4B4347A
SHA256:6400E8B45F4599C61A0D0579C0253ED0A9373A81F5A25450AA9324E4295D7EDC
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\3082\mbapreq.wxlxml
MD5:1024AA88AE01BC7BA797193CC6023375
SHA256:B884C4ABB8867553C1FFADD6721C2135EC5F9F1455C3F668D711CCEA65363D1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
35
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.164.104:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
6200
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6948
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
3788
msiexec.exe
GET
200
2.16.164.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
3788
msiexec.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
DE
binary
1.05 Kb
whitelisted
6948
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
US
binary
312 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5348
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
20.105.216.25:443
aka.bentley.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
89.106.200.1:443
communities.bentley.com
Enflow B.V.
NL
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
149.96.227.108:443
bentleysystems.service-now.com
SNC
US
whitelisted
1268
svchost.exe
2.16.164.104:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
aka.bentley.com
  • 20.105.216.25
whitelisted
communities.bentley.com
  • 89.106.200.1
whitelisted
bentleysystems.service-now.com
  • 149.96.227.108
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.104
  • 2.16.164.72
  • 2.16.164.120
  • 2.16.164.98
  • 2.16.164.105
  • 2.16.164.66
  • 2.16.164.25
  • 2.16.164.35
  • 2.16.164.112
  • 2.16.164.131
  • 2.16.164.74
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.3
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 135.233.95.144
whitelisted

Threats

No threats detected
Process
Message
msiexec.exe
Failed to release Service
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_Viewx64_25.00.00.032.exe