File name:

dInstall.exe

Full analysis: https://app.any.run/tasks/c8902f05-85a8-410f-a2ca-86475a6c38d0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 24, 2025, 07:37:05
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
loader
delphi
inno
installer
miner
github
winring0x64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

CDE2E062E822263577C5C7CE4A71FB92

SHA1:

480380C48916B1FB191A93E961DB93C3C999DBCB

SHA256:

EEB57A7B78BE43BABE3397CB7E45FC3EF906A8F3AE29EB0D4D17CD6C8C42D07B

SSDEEP:

98304:Vrq3BdwXIP1IxEJesOx7l9Lm1QcLmvpMcplq9t6MgW9c+m/WoPaOi4uT/G7GfG17:yT/pQvDRV60SAaMQUkZz11sv9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds extension to the Windows Defender exclusion list

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Uninstalls Malicious Software Removal Tool (MRT)

      • cmd.exe (PID: 4908)
      • cmd.exe (PID: 4516)

    • Changes Windows Defender settings

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Vulnerable driver has been detected

      • ezyrmuerzgtz.exe (PID: 5420)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 1664)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dInstall.exe (PID: 2468)
      • dInstall.exe (PID: 5088)
      • dInstall.tmp (PID: 716)
      • dInstall.tmp (PID: 5312)
      • dInstall.exe (PID: 5604)
      • 7z2409-x64.exe (PID: 5220)
      • wireguard.exe (PID: 3936)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Reads security settings of Internet Explorer

      • dInstall.tmp (PID: 3816)
      • dInstall.tmp (PID: 716)
      • wireguard.exe (PID: 3936)

    • Reads the Internet Settings

      • dInstall.tmp (PID: 3816)
      • dInstall.tmp (PID: 716)
      • wireguard.exe (PID: 3936)

    • Reads the Windows owner or organization settings

      • dInstall.tmp (PID: 716)
      • dInstall.tmp (PID: 5312)

    • Drops 7-zip archiver for unpacking

      • dInstall.tmp (PID: 5312)
      • 7z2409-x64.exe (PID: 5220)

    • Reads settings of System Certificates

      • wireguard.exe (PID: 3936)

    • Creates a software uninstall entry

      • 7z2409-x64.exe (PID: 5220)

    • Creates/Modifies COM task schedule object

      • 7z2409-x64.exe (PID: 5220)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 5132)
      • cmd.exe (PID: 4044)

    • Starts CMD.EXE for commands execution

      • dInstall.tmp (PID: 5312)
      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Adds/modifies Windows certificates

      • wireguard.exe (PID: 3936)

    • There is functionality for taking screenshot (YARA)

      • wireguard.exe (PID: 3936)

    • Application launched itself

      • msiexec.exe (PID: 4212)
      • wireguard.exe (PID: 2116)
      • wireguard.exe (PID: 1088)

    • Executes as Windows Service

      • wireguard.exe (PID: 1088)
      • VSSVC.exe (PID: 4036)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Script adds exclusion path to Windows Defender

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Script adds exclusion extension to Windows Defender

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Manipulates environment variables

      • powershell.exe (PID: 1988)
      • powershell.exe (PID: 4596)

    • Process uninstalls Windows update

      • wusa.exe (PID: 5676)
      • wusa.exe (PID: 5416)

    • Stops a currently running service

      • sc.exe (PID: 4944)
      • sc.exe (PID: 4088)
      • sc.exe (PID: 4996)
      • sc.exe (PID: 3820)
      • sc.exe (PID: 6072)
      • sc.exe (PID: 2472)
      • sc.exe (PID: 5276)
      • sc.exe (PID: 5940)
      • sc.exe (PID: 4128)
      • sc.exe (PID: 1820)
      • sc.exe (PID: 5336)

    • Starts SC.EXE for service management

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Creates a new Windows service

      • sc.exe (PID: 4940)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3644)
      • sc.exe (PID: 5256)

    • Starts POWERSHELL.EXE for commands execution

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Uses powercfg.exe to modify the power settings

      • Violet_Install.exe (PID: 5428)
      • ezyrmuerzgtz.exe (PID: 5420)

    • Drops a system driver (possible attempt to evade defenses)

      • ezyrmuerzgtz.exe (PID: 5420)

    • Crypto Currency Mining Activity Detected

      • svchost.exe (PID: 1664)

  • INFO

    • Checks supported languages

      • dInstall.exe (PID: 5088)
      • dInstall.tmp (PID: 3816)
      • dInstall.tmp (PID: 716)
      • dInstall.exe (PID: 2468)
      • dInstall.tmp (PID: 5312)
      • 7z2409-x64.exe (PID: 5220)
      • wireguard.exe (PID: 3936)
      • dInstall.exe (PID: 5604)
      • 7z.exe (PID: 3840)
      • msiexec.exe (PID: 4212)

    • Create files in a temporary directory

      • dInstall.exe (PID: 5088)
      • dInstall.tmp (PID: 716)
      • dInstall.exe (PID: 5604)
      • dInstall.exe (PID: 2468)
      • dInstall.tmp (PID: 5312)

    • Reads the computer name

      • dInstall.tmp (PID: 716)
      • dInstall.exe (PID: 5604)
      • dInstall.tmp (PID: 5312)
      • wireguard.exe (PID: 3936)
      • 7z2409-x64.exe (PID: 5220)
      • 7z.exe (PID: 3840)
      • msiexec.exe (PID: 4212)
      • dInstall.tmp (PID: 3816)
      • dInstall.exe (PID: 2468)

    • The sample compiled with english language support

      • dInstall.tmp (PID: 5312)
      • 7z2409-x64.exe (PID: 5220)
      • msiexec.exe (PID: 4212)

    • Creates files in the program directory

      • 7z2409-x64.exe (PID: 5220)

    • Checks proxy server information

      • wireguard.exe (PID: 3936)

    • Reads the software policy settings

      • wireguard.exe (PID: 3936)

    • Creates a software uninstall entry

      • dInstall.tmp (PID: 5312)

    • Creates files or folders in the user directory

      • wireguard.exe (PID: 3936)

    • Reads the machine GUID from the registry

      • wireguard.exe (PID: 3936)

    • Detects InnoSetup installer (YARA)

      • dInstall.exe (PID: 5604)
      • dInstall.tmp (PID: 5312)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4212)

    • Compiled with Borland Delphi (YARA)

      • dInstall.exe (PID: 5604)
      • dInstall.tmp (PID: 5312)

    • Manages system restore points

      • SrTasks.exe (PID: 2200)

    • The sample compiled with chinese language support

      • msiexec.exe (PID: 4212)

    • The sample compiled with japanese language support

      • ezyrmuerzgtz.exe (PID: 5420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 171520
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 173.8.4.2
ProductVersionNumber: 173.8.4.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: codesigningstore.com
FileDescription: Inno Script Studio Setup
FileVersion: 173.8.4.2
LegalCopyright:
OriginalFileName:
ProductName: Inno Script Studio
ProductVersion: 173.8.4.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
87
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start dinstall.exe dinstall.tmp no specs dinstall.exe dinstall.tmp dinstall.exe dinstall.tmp wireguard.exe 7z2409-x64.exe cmd.exe no specs conhost.exe no specs setx.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs 7z.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs msiexec.exe vssvc.exe no specs violet_install.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs wireguard.exe no specs wireguard.exe wireguard.exe wireguard.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs THREAT ezyrmuerzgtz.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs explorer.exe #MINER svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
716"C:\Users\admin\AppData\Local\Temp\is-0FHFM.tmp\dInstall.tmp" /SL5="$40342,11830486,857600,C:\Users\admin\Desktop\dInstall.exe" /SPAWNWND=$60040 /NOTIFYWND=$40222 C:\Users\admin\AppData\Local\Temp\is-0FHFM.tmp\dInstall.tmp
dInstall.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\is-0fhfm.tmp\dinstall.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
760C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0C:\Windows\System32\powercfg.exe—Violet_Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
820\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1036\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1088"C:\Program Files\WireGuard\wireguard.exe" /managerserviceC:\Program Files\WireGuard\wireguard.exe
services.exe
User:
SYSTEM
Company:
WireGuard LLC
Integrity Level:
SYSTEM
Description:
WireGuard: Fast, Modern, Secure VPN Tunnel
Version:
0.5.3
Modules
Images
c:\program files\wireguard\wireguard.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\winmm.dll
1272\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1300\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1428\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1508C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0C:\Windows\System32\powercfg.exe—ezyrmuerzgtz.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ucrtbase.dll
1532\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
Total events
37 798
Read events
36 984
Write events
763
Delete events
51

Modification events

(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
CC02000071674BAE7ECCDB01
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
07079C58159A486C192864DF5D9DF756C3CC1CC4B62C0FD4872765618C42E7F9
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
܇墜騕汈⠙�鵝囷쳃쐜Ⲷ퐏➇慥䊌裏
(PID) Process:(716) dInstall.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
ˌ
Executable files
32
Suspicious files
41
Text files
110
Unknown types
0

Dropped files

PID
Process
Filename
Type
5312dInstall.tmpC:\Windows\is-LAGH4.tmpcompressed
MD5:D5DDFBC8FED65B057D79F3FBBC6E8D34
SHA256:626F7DBF857259C71AF04C4B537615FFB78A3A64DE7AD7CB43245EBBF99A188C
5312dInstall.tmpC:\Users\admin\AppData\Local\Temp\is-U7AMI.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
5312dInstall.tmpC:\Windows\unins000.exeexecutable
MD5:21178564D1EA6B85F3527BBEE00A6849
SHA256:A1124F8E83F83577A7C512481EB7FC0FDFE86E021A95C757D273FAC61D114860
5312dInstall.tmpC:\Windows\wireguard.exeexecutable
MD5:1CF9257C07936D7FBF508DC113E9B6D5
SHA256:EEEE2B0A6AD1C7E4614FED4DFBE58B63776F6A3A6758267B5A976B4DC4315F48
5312dInstall.tmpC:\Windows\is-FU6CE.tmpexecutable
MD5:21178564D1EA6B85F3527BBEE00A6849
SHA256:A1124F8E83F83577A7C512481EB7FC0FDFE86E021A95C757D273FAC61D114860
5088dInstall.exeC:\Users\admin\AppData\Local\Temp\is-USAQ6.tmp\dInstall.tmpexecutable
MD5:59B50984D3421A9D74F116E77C246ADF
SHA256:5000747A854DF8F0D61A4F664C0EEB595553BE998B6BBFB62AFF6BC14BB0A65F
5604dInstall.exeC:\Users\admin\AppData\Local\Temp\is-KII53.tmp\dInstall.tmpexecutable
MD5:59B50984D3421A9D74F116E77C246ADF
SHA256:5000747A854DF8F0D61A4F664C0EEB595553BE998B6BBFB62AFF6BC14BB0A65F
5312dInstall.tmpC:\Windows\is-R99SS.tmpexecutable
MD5:1CF9257C07936D7FBF508DC113E9B6D5
SHA256:EEEE2B0A6AD1C7E4614FED4DFBE58B63776F6A3A6758267B5A976B4DC4315F48
716dInstall.tmpC:\Users\admin\AppData\Local\Temp\is-3Q7GC.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
52207z2409-x64.exeC:\Program Files (x86)\7-Zip\History.txttext
MD5:CCAD44B829868FC155D11387F09C4F4B
SHA256:7D6A3D181B5166FFE08F2779903EDD2749C3EF78FD3C0174BDC4380F4A7511B8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
20
DNS requests
12
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3464
smartscreen.exe
GET
200
23.50.131.200:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b6379c0c45d59d7a
unknown
—
—
whitelisted
—
—
POST
200
172.205.25.163:443
https://checkappexec.microsoft.com/windows/shell/actions
unknown
binary
182 b
whitelisted
1352
svchost.exe
GET
200
2.21.20.155:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
—
—
GET
200
136.144.57.121:443
https://download.wireguard.com/windows-client/latest.sig
unknown
text
436 b
—
—
—
GET
200
136.144.57.121:443
https://download.wireguard.com/windows-client/wireguard-amd64-0.5.3.msi
unknown
executable
2.71 Mb
—
3936
wireguard.exe
GET
200
23.209.209.62:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
—
—
whitelisted
3936
wireguard.exe
GET
200
23.209.209.62:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCEHvWxPrG6a7ySOSaswtvvIE%3D
unknown
—
—
whitelisted
3936
wireguard.exe
GET
200
23.209.209.62:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
—
—
whitelisted
3936
wireguard.exe
GET
200
23.209.209.62:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CECW8K%2FMpyhB%2FHqm6iIXUnTs%3D
unknown
—
—
whitelisted
3936
wireguard.exe
GET
200
23.209.209.62:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQXoCibpolAJkHkrE10coCb1HRkIAQUJg%2FwxEgIG83dkfVUVLazs%2FyZ8QgCEHTZ8ttRPCJn%2FUecNgc%2Fex0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1352
svchost.exe
2.21.20.155:80
—
Akamai International B.V.
DE
unknown
3464
smartscreen.exe
172.205.25.163:443
checkappexec.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
VN
whitelisted
3464
smartscreen.exe
23.50.131.200:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
4976
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3936
wireguard.exe
136.144.57.121:443
download.wireguard.com
PACKET
US
malicious
3936
wireguard.exe
23.209.209.62:80
ocsp.entrust.net
PT. Telekomunikasi Selular
ID
whitelisted
1088
wireguard.exe
136.144.57.121:443
download.wireguard.com
PACKET
US
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
3432
svchost.exe
23.197.142.186:443
fs.microsoft.com
Akamai International B.V.
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
checkappexec.microsoft.com
  • 172.205.25.163
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.200
  • 23.50.131.216
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
download.wireguard.com
  • 136.144.57.121
unknown
ocsp.entrust.net
  • 23.209.209.62
whitelisted
fs.microsoft.com
  • 23.197.142.186
whitelisted
self.events.data.microsoft.com
  • 20.189.173.17
whitelisted
pool.hashvault.pro
  • 192.248.189.11
  • 80.240.16.67
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
whitelisted

Threats

PID
Process
Class
Message
1352
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
1664
svchost.exe
Crypto Currency Mining Activity Detected
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
1664
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dInstall.exe