File name:

Setup_Viewx64_25.00.00.032.exe

Full analysis: https://app.any.run/tasks/58e09444-aca5-4fe5-b7a3-d1d0bd8d148e
Verdict: Malicious activity
Analysis date: September 03, 2025, 16:26:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-html
anti-evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

3610DB4D351E5A53B71B5BE649A41448

SHA1:

2A4AC42029BE5C0250A726BBDFF33F4595F257D9

SHA256:

E61BCE342972986B6278F435B931E208DDB6E7464A9CDEE9A478F3853FEB516F

SSDEEP:

98304:w1svXJG6gIS6q7xT9BYrmZvuwgivRztT25zn/GQ4sI+EuHdFaUbJZfNiDnHmVthK:89xySUQP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)

    • The process creates files with name similar to system file names

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • msiexec.exe (PID: 3788)

    • Reads security settings of Internet Explorer

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)

    • Searches for installed software

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • dllhost.exe (PID: 6876)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Starts itself from another location

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • VC_redist.x64.exe (PID: 2232)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)

    • Process drops legitimate windows executable

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 1712)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3788)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3948)

    • Creates a software uninstall entry

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3788)

    • Starts a Microsoft application from unusual location

      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • The process checks if it is being run in the virtual environment

      • msiexec.exe (PID: 3788)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 3788)

    • Application launched itself

      • VC_redist.x64.exe (PID: 6140)
      • VC_redist.x64.exe (PID: 6936)

  • INFO

    • Checks supported languages

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6140)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • msiexec.exe (PID: 1508)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • msiexec.exe (PID: 4544)

    • The sample compiled with english language support

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)

    • Create files in a temporary directory

      • Setup_Viewx64_25.00.00.032.exe (PID: 6492)
      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Reads the computer name

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 1592)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 4112)
      • VC_redist.x64.exe (PID: 6936)
      • VC_redist.x64.exe (PID: 1712)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 4264)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 6980)
      • msiexec.exe (PID: 1508)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)
      • msiexec.exe (PID: 4544)

    • Reads the machine GUID from the registry

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • msiexec.exe (PID: 3788)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Checks proxy server information

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)

    • Disables trace logs

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)

    • Reads the software policy settings

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • msiexec.exe (PID: 3788)

    • Process checks computer location settings

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)
      • VC_redist.x64.exe (PID: 2232)
      • VC_redist.x64.exe (PID: 6936)
      • aspnetcore-runtime-8.0.11-win-x64.exe (PID: 6320)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 4216)

    • Manages system restore points

      • SrTasks.exe (PID: 4200)

    • Launching a file from a Registry key

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Creates files in the program directory

      • Setup_Viewx64_25.00.00.032.exe (PID: 4036)
      • VC_redist.x64.exe (PID: 4112)
      • AspNetCoreSharedFrameworkBundle-x64.exe (PID: 2528)
      • windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 3288)

    • Creates files or folders in the user directory

      • Setup_Viewx64_25.00.00.032.exe (PID: 1560)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3788)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:22 22:14:43+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 314368
InitializedDataSize: 308736
UninitializedDataSize: -
EntryPoint: 0x302e5
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 25.0.0.32
ProductVersionNumber: 25.0.0.32
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Bentley Systems, Incorporated
FileDescription: Bentley View 2025
FileVersion: 25.0.0.32
InternalName: setup
LegalCopyright: Copyright © 2025 Bentley Systems, Incorporated. All rights reserved.
OriginalFileName: Setup_Viewx64_25.00.00.032.exe
ProductName: Bentley View 2025
ProductVersion: 25.0.0.32
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
25
Malicious processes
13
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup_viewx64_25.00.00.032.exe setup_viewx64_25.00.00.032.exe setup_viewx64_25.00.00.032.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe vc_redist.x64.exe vc_redist.x64.exe vc_redist.x64.exe SPPSurrogate no specs vc_redist.x64.exe no specs vc_redist.x64.exe vc_redist.x64.exe aspnetcore-runtime-8.0.11-win-x64.exe aspnetcore-runtime-8.0.11-win-x64.exe aspnetcoresharedframeworkbundle-x64.exe SPPSurrogate no specs msiexec.exe no specs slui.exe no specs windowsdesktop-runtime-8.0.11-win-x64.exe windowsdesktop-runtime-8.0.11-win-x64.exe windowsdesktop-runtime-8.0.11-win-x64.exe msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1508C:\Windows\syswow64\MsiExec.exe -Embedding AE5066A658F67028BD57416538C88D53C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1560"C:\Users\admin\AppData\Local\Temp\{BC1F8B03-F027-4AD3-B0D5-6EB7BA9FC47A}\.cr\Setup_Viewx64_25.00.00.032.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\Setup_Viewx64_25.00.00.032.exe" -burn.filehandle.attached=584 -burn.filehandle.self=700 C:\Users\admin\AppData\Local\Temp\{BC1F8B03-F027-4AD3-B0D5-6EB7BA9FC47A}\.cr\Setup_Viewx64_25.00.00.032.exe
Setup_Viewx64_25.00.00.032.exe
User:
admin
Company:
Bentley Systems, Incorporated
Integrity Level:
MEDIUM
Description:
Bentley View 2025
Version:
25.0.0.32
Modules
Images
c:\users\admin\appdata\local\temp\{bc1f8b03-f027-4ad3-b0d5-6eb7ba9fc47a}\.cr\setup_viewx64_25.00.00.032.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1592"C:\ProgramData\Package Cache\38B647D37B42378222856972A1E22FBD8CF4B404\VC_redist.x64.exe" /install /quiet /norestartC:\ProgramData\Package Cache\38B647D37B42378222856972A1E22FBD8CF4B404\VC_redist.x64.exe
Setup_Viewx64_25.00.00.032.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433
Exit code:
3010
Version:
14.42.34433.0
Modules
Images
c:\programdata\package cache\38b647d37b42378222856972a1e22fbd8cf4b404\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1712"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0DC9EC85-D92F-48DF-A553-73AA541F18BB} {62CEE5A9-23ED-4B73-8AB6-A4AC51AB1B43} 6936C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532
Exit code:
0
Version:
14.36.32532.0
Modules
Images
c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2232"C:\WINDOWS\Temp\{A0674FC5-F8B8-4116-B018-CD9F12B5A921}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\38B647D37B42378222856972A1E22FBD8CF4B404\VC_redist.x64.exe" -burn.filehandle.attached=708 -burn.filehandle.self=560 /install /quiet /norestartC:\Windows\Temp\{A0674FC5-F8B8-4116-B018-CD9F12B5A921}\.cr\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433
Exit code:
3010
Version:
14.42.34433.0
Modules
Images
c:\windows\temp\{a0674fc5-f8b8-4116-b018-cd9f12b5a921}\.cr\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2528"C:\WINDOWS\Temp\{41804788-399B-4473-A1B1-B8D0D44F8B33}\.be\AspNetCoreSharedFrameworkBundle-x64.exe" -q -burn.elevated BurnPipe.{AEEF2CDF-0D4F-4419-9927-EB110B6109E2} {FA949C4E-69C2-4729-B438-1DD85B688733} 6320C:\Windows\Temp\{41804788-399B-4473-A1B1-B8D0D44F8B33}\.be\AspNetCoreSharedFrameworkBundle-x64.exe
aspnetcore-runtime-8.0.11-win-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ASP.NET Core 8.0.11 - Shared Framework (x64)
Exit code:
0
Version:
8.0.11.24521
Modules
Images
c:\windows\temp\{41804788-399b-4473-a1b1-b8d0d44f8b33}\.be\aspnetcoresharedframeworkbundle-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3288"C:\WINDOWS\Temp\{43C33E42-AC1E-407F-A58D-585C71A1AA0D}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{2DFC76F9-6C43-4751-973D-ABA675EBE418} {8BD12DA5-ABB3-4A40-8F4C-7B880A4BF849} 4216C:\Windows\Temp\{43C33E42-AC1E-407F-A58D-585C71A1AA0D}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
windowsdesktop-runtime-8.0.11-win-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Desktop Runtime - 8.0.11 (x64)
Version:
8.0.11.34221
Modules
Images
c:\windows\temp\{43c33e42-ac1e-407f-a58d-585c71a1aa0d}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3788C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3948C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4024C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
22 384
Read events
20 367
Write events
1 600
Delete events
417

Modification events

(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1560) Setup_Viewx64_25.00.00.032.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Setup_Viewx64_25_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
322
Suspicious files
132
Text files
145
Unknown types
0

Dropped files

PID
Process
Filename
Type
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\WixInstallBA.dllexecutable
MD5:9B231188A8A7029B93203A78A4B4347A
SHA256:6400E8B45F4599C61A0D0579C0253ED0A9373A81F5A25450AA9324E4295D7EDC
6492Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{BC1F8B03-F027-4AD3-B0D5-6EB7BA9FC47A}\.cr\Setup_Viewx64_25.00.00.032.exeexecutable
MD5:A71DEE8546111E412C34E3E73D590429
SHA256:D714A840D8ECD46D23092E6A531E4CD2791C1623E6488A3BA84158ADAD69593D
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\Winterop.dllexecutable
MD5:695BD38BB62302A0903E4CED008A73DD
SHA256:5EE45A965AA6BD6C00C795BDB394B9A8D911FBC8961EF62E55014F53EFE64F9F
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\mbahost.dllexecutable
MD5:E3471734DF4345B4EC9F60333A96982B
SHA256:D728E7449243BC7099890BADB6FAE3F2B082A80D9C950E498051F89A65D48687
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\SetupPagesLib.dllexecutable
MD5:F22A30EB9EEC8E25C64D76FE8ECFEFCD
SHA256:092F766D6E1B731E4CF4B763234AA7D1C039D4A5BAD0E67C18C0EE3E3E5AA76F
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\PPInstallerExtension.beext.dllexecutable
MD5:D5F99B7327271803DEC6D0947A74E4EA
SHA256:D8D81DF6FE24537F7E9F8DE60A55419CB69523D7F39BC6E105B40830AE23A070
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\BootstrapperCore.dllexecutable
MD5:E808F606E54D6F823B9D22F56E8982FC
SHA256:CF2AE76D1DA5AF70A72259E7E51DAE62C715BC32239DAF5DA6B1BDE122BCDAB6
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\mbapreq.wxlxml
MD5:4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA256:C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\ObjectEnablerLookUpExtension.beext.dllexecutable
MD5:26C195C53DC350D1248D314337E866D5
SHA256:4075434B30A93B5481F2E1CB5B9244509A111EEC717B25D5FCC260BF88A7AFBD
1560Setup_Viewx64_25.00.00.032.exeC:\Users\admin\AppData\Local\Temp\{FA4F9192-4A2C-4E55-859D-0DE9BCD262CF}\.ba\1030\mbapreq.wxlxml
MD5:7C6E4CE87870B3B5E71D3EF4555500F8
SHA256:CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
35
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6948
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
1268
svchost.exe
GET
200
2.16.164.104:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
6200
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6948
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
US
binary
312 b
whitelisted
3788
msiexec.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
DE
binary
1.05 Kb
whitelisted
3788
msiexec.exe
GET
200
2.16.164.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5348
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
20.105.216.25:443
aka.bentley.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
89.106.200.1:443
communities.bentley.com
Enflow B.V.
NL
whitelisted
1560
Setup_Viewx64_25.00.00.032.exe
149.96.227.108:443
bentleysystems.service-now.com
SNC
US
whitelisted
1268
svchost.exe
2.16.164.104:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
aka.bentley.com
  • 20.105.216.25
whitelisted
communities.bentley.com
  • 89.106.200.1
whitelisted
bentleysystems.service-now.com
  • 149.96.227.108
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.104
  • 2.16.164.72
  • 2.16.164.120
  • 2.16.164.98
  • 2.16.164.105
  • 2.16.164.66
  • 2.16.164.25
  • 2.16.164.35
  • 2.16.164.112
  • 2.16.164.131
  • 2.16.164.74
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.3
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 135.233.95.144
whitelisted

Threats

No threats detected
Process
Message
msiexec.exe
Failed to release Service
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_Viewx64_25.00.00.032.exe