File name:

setup.exe

Full analysis: https://app.any.run/tasks/9e1f3cc4-c1af-49b9-b1d2-cd2c3967569e
Verdict: Malicious activity
Analysis date: March 24, 2025, 12:54:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

2E36F00BB9A8326DFAA9A52ECA043EE5

SHA1:

CE3A098BB3EFBA7A052CE935D8041EAC7F5C6E8D

SHA256:

E99BF73506D9DA8A78A87D40F931E70C717C8DC8E703394EB2F934DD918237B0

SSDEEP:

98304:xHX8IqXt40x4IYoXgzxGbryVfVYGC0q1lupnVEkHi8rSHrQ835NA1R0iObMX/TCe:sGfor6Sik0zw5jsiqozaSvy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executing commands from ".cmd" file

      • setup.exe (PID: 3132)

    • Application launched itself

      • setup.exe (PID: 6872)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 1096)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 5164)
      • setup.exe (PID: 3132)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 1628)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 6872)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 5164)
      • setup.exe (PID: 3132)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 6872)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1628)

    • Hides command output

      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 1804)

    • Uses NSLOOKUP.EXE to check DNS info

      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 1804)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 1804)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 1628)

    • The executable file from the user directory is run by the CMD process

      • wget.exe (PID: 632)
      • dnsx.exe (PID: 7148)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 1628)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 1628)

    • Reads the date of Windows installation

      • setup.exe (PID: 3132)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 1628)

  • INFO

    • Checks supported languages

      • setup.exe (PID: 6872)
      • setup.exe (PID: 3132)
      • setup.exe (PID: 5164)
      • dnsx.exe (PID: 7148)

    • Reads the computer name

      • setup.exe (PID: 6872)
      • setup.exe (PID: 3132)

    • Create files in a temporary directory

      • setup.exe (PID: 6872)
      • dnsx.exe (PID: 7148)

    • Changes file name

      • cmd.exe (PID: 5344)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 5892)
      • BackgroundTransferHost.exe (PID: 2040)
      • BackgroundTransferHost.exe (PID: 1764)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 2040)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 2040)

    • Process checks computer location settings

      • setup.exe (PID: 3132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2018:05:21 01:49:53+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 10
CodeSize: 126976
InitializedDataSize: 146944
UninitializedDataSize: -
EntryPoint: 0x1f550
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 7.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Adobe Systems Incorporated
FileDescription: Adobe Setup
FileVersion: 7.0.0.0
InternalName: PostInstall
LegalCopyright: © 1990-2024 Adobe Systems Inc
OriginalFileName: setup.exe
PrivateBuild: September 14, 2024
ProductName: Setup
ProductVersion: 7.0.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
692
Monitored processes
565
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe setup.exe no specs cmd.exe no specs conhost.exe no specs setup.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs ping.exe no specs findstr.exe no specs cmd.exe no specs nslookup.exe findstr.exe no specs cmd.exe no specs nslookup.exe findstr.exe no specs cmd.exe no specs nslookup.exe findstr.exe no specs wget.exe findstr.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs backgroundtransferhost.exe no specs cmd.exe no specs findstr.exe no specs dnsx.exe sort.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs backgroundtransferhost.exe cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs backgroundtransferhost.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs backgroundtransferhost.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs backgroundtransferhost.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs ipconfig.exe no specs netsh.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208findstr /l /c:",143.204.55.74," C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
208findstr /l /c:",18.165.122.78," C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
208findstr /l /c:",52.85.49.123," C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
208C:\WINDOWS\system32\cmd.exe /S /D /c" echo ,108.156.22.32,108.156.22.44,108.156.22.46,108.156.22.63,13.227.219.41,13.227.219.60,13.227.219.63,13.227.219.90,143.204.55.10,143.204.55.100,143.204.55.102,143.204.55.103,143.204.55.113,143.204.55.115,143.204.55.117,143.204.55.118,143.204.55.12,143.204.55.123,143.204.55.126,143.204.55.127,143.204.55.15,143.204.55.16,143.204.55.18,143.204.55.20,143.204.55.21,143.204.55.22,143.204.55.23,143.204.55.24,143.204.55.28,143.204.55.29,143.204.55.31,143.204.55.35,143.204.55.36,143.204.55.39,143.204.55.41,143.204.55.46,143.204.55.48,143.204.55.49,143.204.55.5,143.204.55.50,143.204.55.53,143.204.55.54,143.204.55.6,143.204.55.60,143.204.55.64,143.204.55.69,143.204.55.73,143.204.55.74,143.204.55.77,143.204.55.81,143.204.55.83,143.204.55.85,143.204.55.86,143.204.55.87,143.204.55.88,143.204.55.9,143.204.55.90,143.204.55.93,143.204.55.94,143.204.55.95,143.204.55.97,18.165.122.23,18.165.122.27,18.165.122.31,18.165.122.47,18.165.122.5,18.165.122.73,18.165.122.74,18.165.122.78,18.165.122.82,18.165.122.88,18.165.122.93,18.165.122.95,18.165.140.11,18.165.140.116,18.165.140.121,18.165.140.125,18.165.140.39,18.165.140.57,18.165.140.62,18.165.140.74,18.165.140.8,18.165.140.89,18.165.140.91,18.165.140.92,18.239.36.105,18.239.36.111,18.239.36.125,18.239.36.14,18.239.36.25,18.239.36.4,18.239.36.53,18.239.36.69,18.239.36.75,18.239.36.78,18.239.36.84,18.239.36.99,18.239.69.102,18.239.69.105,18.239.69.123,18.239.69.15,18.239.69.32,18.239.69.33,18.239.69.40,18.239.69.41,18.239.69.49,18.239.69.56,18.239.69.59,18.239.69.62,18.239.69.67,18.239.69.71,18.239.69.79,18.239.69.81,18.239.69.90,18.239.69.94,18.239.69.97,18.239.83.113,18.239.83.14,18.239.83.27,18.239.83.87,18.239.94.26,18.239.94.73,18.239.94.80,18.239.94.85,18.65.39.126,18.65.39.23,18.65.39.27,18.65.39.37,18.65.39.41,18.65.39.56,18.65.39.78,18.65.39.97,3.164.206.100,3.164.206.104,3.164.206.107,3.164.206.120,3.164.206.3,3.164.206.35,3.164.206.4,3.164.206.48,3.164.206.51,3.164.206.61,3.164.206.65,3.164.206.8,3.164.206.83,3.164.206.85,3.164.206.90,3.164.206.97,3.164.68.10,3.164.68.100,3.164.68.105,3.164.68.128,3.164.68.13,3.164.68.2,3.164.68.20,3.164.68.34,3.164.68.35,3.164.68.36,3.164.68.37,3.164.68.40,3.164.68.47,3.164.68.54,3.164.68.59,3.164.68.66,3.164.68.70,3.164.68.79,3.164.68.81,3.164.68.83,3.164.68.87,3.164.68.96,3.164.68.99,52.85.49.102,52.85.49.108,52.85.49.112,52.85.49.121,52.85.49.122,52.85.49.123,52.85.49.124,52.85.49.126,52.85.49.127,52.85.49.129,52.85.49.13,52.85.49.16,52.85.49.18,52.85.49.19,52.85.49.22,52.85.49.30,52.85.49.42,52.85.49.49,52.85.49.53,52.85.49.54,52.85.49.60,52.85.49.62,52.85.49.66,52.85.49.71,52.85.49.72,52.85.49.73,52.85.49.74,52.85.49.77,52.85.49.78,52.85.49.80,52.85.49.86,52.85.49.89,52.85.49.94,52.85.49.96,52.85.49.99,54.240.174.100,54.240.174.102,54.240.174.104,54.240.174.105,54.240.174.110,54.240.174.112,54.240.174.113,54.240.174.115,54.240.174.117,54.240.174.118,54.240.174.119,54.240.174.121,54.240.174.123,54.240.174.126,54.240.174.15,54.240.174.16,54.240.174.17,54.240.174.19,54.240.174.23,54.240.174.26,54.240.174.28,54.240.174.3,54.240.174.30,54.240.174.39,"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
516nslookup -type=ns ic.adobe.ioC:\Windows\System32\nslookup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\nslookup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
516findstr /l /c:",13.227.219.41," C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
516findstr /l /c:",143.204.55.102," C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
516C:\WINDOWS\system32\cmd.exe /S /D /c" echo ,108.156.22.32,108.156.22.44,108.156.22.46,108.156.22.63,13.227.219.41,13.227.219.60,13.227.219.63,13.227.219.90,143.204.55.10,143.204.55.100,143.204.55.102,143.204.55.103,143.204.55.113,143.204.55.115,143.204.55.117,143.204.55.118,143.204.55.12,143.204.55.123,143.204.55.126,143.204.55.127,143.204.55.15,143.204.55.16,143.204.55.18,143.204.55.20,143.204.55.21,143.204.55.22,143.204.55.23,143.204.55.24,143.204.55.28,143.204.55.29,"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
516findstr /l /c:",143.204.55.60," C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
516C:\WINDOWS\system32\cmd.exe /S /D /c" echo ,108.156.22.32,108.156.22.44,108.156.22.46,108.156.22.63,13.227.219.41,13.227.219.60,13.227.219.63,13.227.219.90,143.204.55.10,143.204.55.100,143.204.55.102,143.204.55.103,143.204.55.113,143.204.55.115,143.204.55.117,143.204.55.118,143.204.55.12,143.204.55.123,143.204.55.126,143.204.55.127,143.204.55.15,143.204.55.16,143.204.55.18,143.204.55.20,143.204.55.21,143.204.55.22,143.204.55.23,143.204.55.24,143.204.55.28,143.204.55.29,143.204.55.31,143.204.55.35,143.204.55.36,143.204.55.39,143.204.55.41,143.204.55.46,143.204.55.48,143.204.55.49,143.204.55.5,143.204.55.50,143.204.55.53,143.204.55.54,143.204.55.6,143.204.55.60,143.204.55.64,143.204.55.69,143.204.55.73,143.204.55.74,143.204.55.77,143.204.55.81,143.204.55.83,"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 190
Read events
13 175
Write events
15
Delete events
0

Modification events

(PID) Process:(5064) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5064) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5064) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5892) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5892) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5892) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1764) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
3
Suspicious files
7
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f7af7fb2-84fb-4d09-b4bf-5f8178e0e572.down_data —
MD5:—
SHA256:—
6872setup.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\BlockIPs.cmdtext
MD5:70532EBA6100358F5BA7620D9B2A0843
SHA256:5259BADC06BA77606C3C01A54CEAB7175C3A237668D3EABB4445C38FE6CD9998
6872setup.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\iplist.txttext
MD5:EC97A1797E1DB06984534B0F5AEFE1B9
SHA256:303AEED937DE96236F5DDDBA75AA69D1AEB9CCC720F3C194995567C1A55B435E
4180findstr.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\pihole_new.txttext
MD5:62E6DB72C8EF7AB4E752E6F72FFA10E7
SHA256:ACA25829C8342F9382FBEC7A6471ADCA20383B9931EE3F1CE6B9A121B1C17802
6872setup.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\wget.exeexecutable
MD5:B1F557BD6A97A95CFF5DBCC55BF6E9BB
SHA256:A6093F8F40F90AD576B0463FB352318416EA24265D3E8F43D4F7F3723F7E7F77
6872setup.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\Cinema 4D.exeexecutable
MD5:7CB555EF42F62F2ED00CDF1E4EC29262
SHA256:EE65DB81929E045AEFFE5636781476CDCF1AD9ED89401257F7BD3CD265E09E36
1628cmd.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\pihole.txttext
MD5:62E6DB72C8EF7AB4E752E6F72FFA10E7
SHA256:ACA25829C8342F9382FBEC7A6471ADCA20383B9931EE3F1CE6B9A121B1C17802
7148dnsx.exeC:\Users\admin\AppData\Local\Temp\hm401168435\CURRENT.0text
MD5:6159AC332FBA78E3046D9F75EDB5E396
SHA256:179AEE986B08DD1C9B42165766A9F86BE710E30D130C79FF234C4F8FBFB85F76
7148dnsx.exeC:\Users\admin\AppData\Local\Temp\hm401168435\CURRENTtext
MD5:6159AC332FBA78E3046D9F75EDB5E396
SHA256:179AEE986B08DD1C9B42165766A9F86BE710E30D130C79FF234C4F8FBFB85F76
6872setup.exeC:\Users\admin\AppData\Local\Temp\Adobe After Effects Temp\pihole.txttext
MD5:A99C6DFB15DF493B45934795DFCF7DD4
SHA256:83DA0D25731D61F77F2311A11DC15FB9066AD27A49010BD301EBB06B5A0E59B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
1 404
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4408
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2040
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5228
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5228
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4408
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4408
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
632
wget.exe
104.21.16.1:443
a.dove.isdumb.one
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.131
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
2.100.168.192.in-addr.arpa
  • —
whitelisted
ic.adobe.io
  • —
whitelisted
a.dove.isdumb.one
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.32.1
unknown
017sxef5kv.adobestats.io
  • 52.85.49.54
  • 52.85.49.94
  • 52.85.49.112
  • 52.85.49.42
unknown
04jkjo2db5.adobestats.io
  • 143.204.55.10
  • 143.204.55.54
  • 143.204.55.115
  • 143.204.55.39
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe