File name:

kav21.3.10.391abcdefghijklen_26157.exe

Full analysis: https://app.any.run/tasks/50db4424-e80a-4605-85ab-c1ea9de78467
Verdict: Malicious activity
Analysis date: December 09, 2024, 08:19:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

69DD39AAD54AB8646E9FC520CEC1DD01

SHA1:

0723D4FE16B5DF6589CE60F3EF44E09F1B10B3F6

SHA256:

F367025F71C510F9A71DC57F104E92B57D3614FC6FE221CFF4202AFE091DE1A3

SSDEEP:

98304:SKBwrBZbYrniSos+jMPSyK88tXmgeYXRlPdjE48/V1otBbQEIHoEdni8RJwjhvdI:cIv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)

    • Application launched itself

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)

    • Reads security settings of Internet Explorer

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)
      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

    • Executable content was dropped or overwritten

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)
      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

    • Checks Windows Trust Settings

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

    • The process verifies whether the antivirus software is installed

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

  • INFO

    • Reads the computer name

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)
      • TEST_WPF.EXE (PID: 4392)

    • Checks supported languages

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)

    • Process checks whether UAC notifications are on

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)

    • Checks proxy server information

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)

    • Create files in a temporary directory

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)
      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

    • The process uses the downloaded file

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)
      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

    • Reads the machine GUID from the registry

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)
      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)
      • TEST_WPF.EXE (PID: 4392)

    • Checks for the presence of KasperskyLab

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)
      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 6676)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)

    • Creates files in the program directory

      • kav21.3.10.391abcdefghijklen_26157.exe (PID: 3364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1972:01:30 11:30:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 302080
InitializedDataSize: 2372096
UninitializedDataSize: -
EntryPoint: 0x24c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 21.3.10.391
ProductVersionNumber: 21.3.10.391
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Kaspersky
FileDescription: Kaspersky Anti-Virus [21.3.10.391.0.2472.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
FileVersion: 21.3.10.391
LegalCopyright: © 2021 AO Kaspersky Lab
LegalTrademarks: Registered trademarks and service marks are the property of their respective owners
ProductName: Kaspersky Anti-Virus
ProductVersion: 21.3.10.391
InternalName: Setup
OriginalFileName: Setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kav21.3.10.391abcdefghijklen_26157.exe kav21.3.10.391abcdefghijklen_26157.exe test_wpf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3364"C:\Users\admin\AppData\Local\Temp\kav21.3.10.391abcdefghijklen_26157.exe" /-elevated=C:\Users\admin\AppData\Local\Temp\kav21.3.10.391abcdefghijklen_26157.exe
kav21.3.10.391abcdefghijklen_26157.exe
User:
admin
Company:
Kaspersky
Integrity Level:
HIGH
Description:
Kaspersky Anti-Virus [21.3.10.391.0.2472.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
Version:
21.3.10.391
Modules
Images
c:\users\admin\appdata\local\temp\kav21.3.10.391abcdefghijklen_26157.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\dbghelp.dll
4392"C:\Users\admin\AppData\Local\Temp\66649403-B606-11EF-B4EA-18F7786F96EE\TEST_WPF.EXE" "C:\Users\admin\AppData\Local\Temp\10494666606BFE114BAE817F87F669EE\setup.dll"C:\Users\admin\AppData\Local\Temp\66649403-B606-11EF-B4EA-18F7786F96EE\TEST_WPF.EXE—kav21.3.10.391abcdefghijklen_26157.exe
User:
admin
Integrity Level:
HIGH
Description:
test_wpf
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\66649403-b606-11ef-b4ea-18f7786f96ee\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6676"C:\Users\admin\AppData\Local\Temp\kav21.3.10.391abcdefghijklen_26157.exe" C:\Users\admin\AppData\Local\Temp\kav21.3.10.391abcdefghijklen_26157.exe
explorer.exe
User:
admin
Company:
Kaspersky
Integrity Level:
MEDIUM
Description:
Kaspersky Anti-Virus [21.3.10.391.0.2472.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
Version:
21.3.10.391
Modules
Images
c:\users\admin\appdata\local\temp\kav21.3.10.391abcdefghijklen_26157.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\dbghelp.dll
Total events
12 144
Read events
11 978
Write events
157
Delete events
9

Modification events

(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_ep_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_ep_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_marketing_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_ep_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_marketing_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksde_eula_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_ep_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_marketing_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksde_eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksde_eula_gdpr_en.txt
(PID) Process:(6676) kav21.3.10.391abcdefghijklen_26157.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2472.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0 C:\ProgramData\Kaspersky Lab Setup Files C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-bases-x64-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\index-kleaner-2.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb.z C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\kdscrl.rdb C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_antispam_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_ep_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksn_marketing_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksde_eula_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksde_eula_gdpr_en.txt C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2472.0\ksde_ksn_en.txt
Executable files
4
Suspicious files
34
Text files
26
Unknown types
12

Dropped files

PID
Process
Filename
Type
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-print.csstext
MD5:1304724DD5001B2600FC5BD80C098F1E
SHA256:2481B34B48FD96B194405DA621E8E5F19142DCB55744F9C9A93591705CB697FD
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\check_new_version.htmlhtml
MD5:B79AB8145423E4714F4D3623A7913EEF
SHA256:59A439DEBCEA1F039382E258A337031F9878450AFBCE19A2A52A37783009FAFE
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-script.jsbinary
MD5:026425CCBF4417EEFA444285707132EF
SHA256:97E5F342227EA23C27C1B660F111847FCDD9D7B23C1D248C733A36F983FD7F04
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\jquery-1.12.4.min.jss
MD5:4F252523D4AF0B478C810C2547A63E19
SHA256:668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-script-lte-ie8.jstxt
MD5:5134186180074C51639D7A514919ED23
SHA256:33E84B33FF911257E3A6A303C08A2CC178827DADB7DFD7C951E096866E02AD5E
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-logo.pngimage
MD5:18F81892DAA926FEC1D30324B4CD9367
SHA256:681A96B96B5E0425FC74BE929D29164528BF0BC0A84AC97952C011E407E23D9B
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-style.csstext
MD5:2B4BD0AFD0E9DD5C90FB8C3BB4A5D619
SHA256:F9963B403E053F6BFA7C87CAD3C10DD55CF1F94FEFE00C6380921440E28B48D2
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\jquery.custom_select.min.jsbinary
MD5:D2C620C462B75696EEA1FB22FB23602A
SHA256:DD678D32073078552E0E2C35EED78F16CC8D6E8662D4734518561A1B183F775C
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-loading.gifimage
MD5:69D4B9B309BFA6A87F7620647BAFD2D0
SHA256:F056164CF99799234C90E2318E90AB5D83D0FD855118224286FF0680EE455734
6676kav21.3.10.391abcdefghijklen_26157.exeC:\Users\admin\AppData\Local\Temp\5D2B00F6-B606-11EF-B4EA-18F7786F96EE\kis-information.pngimage
MD5:9D7538A49BFAF3B735DDF21024655371
SHA256:B4B92359798E8F3CFA4063F2EBD097CB66C5B9A4AB962BD1BAC839243440F816
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
41
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6676
kav21.3.10.391abcdefghijklen_26157.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
3364
kav21.3.10.391abcdefghijklen_26157.exe
GET
301
77.74.177.233:80
http://redirect.kaspersky.com/slideshow_default
unknown
—
—
whitelisted
3364
kav21.3.10.391abcdefghijklen_26157.exe
GET
301
77.74.177.233:80
http://redirect.kaspersky.com/slideshow_default
unknown
—
—
whitelisted
3364
kav21.3.10.391abcdefghijklen_26157.exe
GET
301
77.74.177.233:80
http://redirect.kaspersky.com/slideshow_default
unknown
—
—
whitelisted
6508
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6932
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1016
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.23.209.161:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 2.23.209.161
  • 2.23.209.160
  • 2.23.209.169
  • 2.23.209.168
  • 2.23.209.164
  • 2.23.209.162
  • 2.23.209.159
  • 2.23.209.166
  • 2.23.209.167
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.73
  • 20.190.159.23
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
dm.s.kaspersky-labs.com
  • 80.239.169.147
  • 109.248.196.5
  • 80.231.123.135
unknown
redirect.kaspersky.com
  • 77.74.177.233
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kav21.3.10.391abcdefghijklen_26157.exe