File name:

YoutubeMusicDownloader_Setup.exe

Full analysis: https://app.any.run/tasks/e8d40ac3-ef49-454c-ad1f-b5edc388b7ea
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 01, 2025, 03:15:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

5306D60D73C91708BCF336A0B75B8F13

SHA1:

B6CFF5EB75A2D02F1F93DA99524929CDB0733BB6

SHA256:

F52354B10224C8DA9523ED7D3186686C278196EE81D846E26A6243CD38718CC1

SSDEEP:

24576:6OZE0TtJzQ32uMi3ZL/TaaRWftxmyF7AmplUa8boO8VE2Lq:6wE0JJzQ32uMi3ZL7aaRWftxmypAm7Ur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • YoutubeMusicDownloader_Setup.exe (PID: 1752)
      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • Reads security settings of Internet Explorer

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • YoutubeMusicDownloader.exe (PID: 5548)
      • Setup.tmp (PID: 4748)

    • Reads the Windows owner or organization settings

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.tmp (PID: 4748)

    • Process requests binary or script from the Internet

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)

    • There is functionality for taking screenshot (YARA)

      • Setup.tmp (PID: 4748)

    • Potential Corporate Privacy Violation

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)

  • INFO

    • Checks supported languages

      • YoutubeMusicDownloader_Setup.exe (PID: 1752)
      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)
      • YoutubeMusicDownloader.exe (PID: 5548)
      • identity_helper.exe (PID: 1204)
      • identity_helper.exe (PID: 8096)

    • Reads the computer name

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • YoutubeMusicDownloader.exe (PID: 5548)
      • Setup.tmp (PID: 4748)
      • identity_helper.exe (PID: 1204)
      • identity_helper.exe (PID: 8096)

    • Create files in a temporary directory

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.exe (PID: 3888)
      • YoutubeMusicDownloader_Setup.exe (PID: 1752)
      • Setup.tmp (PID: 4748)

    • Checks proxy server information

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.tmp (PID: 4748)
      • YoutubeMusicDownloader.exe (PID: 5548)

    • Process checks computer location settings

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)

    • Compiled with Borland Delphi (YARA)

      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • Detects InnoSetup installer (YARA)

      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • The sample compiled with english language support

      • Setup.tmp (PID: 4748)

    • Creates a software uninstall entry

      • Setup.tmp (PID: 4748)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 4748)

    • Application launched itself

      • msedge.exe (PID: 6732)
      • msedge.exe (PID: 4080)
      • msedge.exe (PID: 6400)
      • msedge.exe (PID: 5780)
      • msedge.exe (PID: 7484)

    • Reads Environment values

      • identity_helper.exe (PID: 1204)
      • identity_helper.exe (PID: 8096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: StubInstaller
FileDescription: StubInstaller Setup
FileVersion:
LegalCopyright:
ProductName: StubInstaller
ProductVersion: 1.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
188
Monitored processes
50
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start youtubemusicdownloader_setup.exe youtubemusicdownloader_setup.tmp setup.exe setup.tmp youtubemusicdownloader.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2192,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7ffc455bf208,0x7ffc455bf214,0x7ffc455bf220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=3380,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
1732"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=4956,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1752"C:\Users\admin\AppData\Local\Temp\YoutubeMusicDownloader_Setup.exe" C:\Users\admin\AppData\Local\Temp\YoutubeMusicDownloader_Setup.exe
explorer.exe
User:
admin
Company:
StubInstaller
Integrity Level:
MEDIUM
Description:
StubInstaller Setup
Exit code:
1
Version:
Modules
Images
c:\users\admin\appdata\local\temp\youtubemusicdownloader_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1828"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffc455bf208,0x7ffc455bf214,0x7ffc455bf220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2276"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2784,i,12685032439956154154,6718899689136648782,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3616,i,12685032439956154154,6718899689136648782,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4140,i,12685032439956154154,6718899689136648782,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2668"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=3380,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
Total events
10 412
Read events
10 333
Write events
79
Delete events
0

Modification events

(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
FC1600002689CF7236EADB01
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
6D9DBEAD3D13A9247BF578B0F33C1DA347C905DCC2492515EDBBDEFAC05F920B
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
30
Suspicious files
313
Text files
103
Unknown types
3

Dropped files

PID
Process
Filename
Type
1752YoutubeMusicDownloader_Setup.exeC:\Users\admin\AppData\Local\Temp\is-1UF2K.tmp\YoutubeMusicDownloader_Setup.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
4748Setup.tmpC:\Users\admin\AppData\Local\YouTubeDownloader\is-CM1E1.tmpexecutable
MD5:2CF1BFE3D05A2CAB9D0845C1313C6691
SHA256:22CEEB1C4B75BA0BA6667CD5EA32438389BC73D79512146AF3FECDC0FE4B8AEE
3888Setup.exeC:\Users\admin\AppData\Local\Temp\is-UHLED.tmp\Setup.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
4748Setup.tmpC:\Users\admin\AppData\Local\Temp\is-AATAK.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4748Setup.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Youtube Music Downloader\Youtube Downloader.lnkbinary
MD5:134D0F5D6FFFB73C2D47B29B6A77395E
SHA256:E0AA2CA2CB50B4D19CE9E5A0756F0FE610397D578505AB0BB77F35AEC59647E7
6400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:EB0AECD0551E36D91C996742D6D5BA9D
SHA256:86A46850BEB77118A25CC1B816E93249F169ADB5794F99A66E08000CE87F7342
4748Setup.tmpC:\Users\admin\AppData\Local\YouTubeDownloader\unins000.datbinary
MD5:FFD87D09F18AA97662089805935E4F74
SHA256:DD0FBCA37D27CF623FFA283C92DEA0A192230AA0240F04399F57BF3F5AEFF0B9
5884YoutubeMusicDownloader_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-TVA9J.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF17a681.TMP —
MD5:—
SHA256:—
6400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
107
DNS requests
149
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4748
Setup.tmp
GET
200
66.165.241.118:80
http://vtransmit.com/getip.php?k=v10
unknown
—
—
unknown
5884
YoutubeMusicDownloader_Setup.tmp
GET
302
104.21.48.1:80
http://ytmusicdownloader.us/download/updates/vcredist_x86.exe
unknown
—
—
unknown
5884
YoutubeMusicDownloader_Setup.tmp
GET
200
104.21.48.1:80
http://ytmusicdownloader.us/download/latest/s/vcredist_x86.exe
unknown
—
—
unknown
5548
YoutubeMusicDownloader.exe
GET
200
143.204.102.122:80
http://d1c3qo5dp2qej9.cloudfront.net/php/alive.php
unknown
—
—
whitelisted
3392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5548
YoutubeMusicDownloader.exe
GET
200
143.204.102.122:80
http://d1c3qo5dp2qej9.cloudfront.net/php/update.php?m=a000b&s=0
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
632
msedge.exe
GET
200
66.165.241.118:80
http://streaming-audio-recorder.org/?id=ymd
unknown
—
—
unknown
632
msedge.exe
GET
200
66.165.241.118:80
http://streaming-audio-recorder.org/images/logo.png
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5708
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5884
YoutubeMusicDownloader_Setup.tmp
104.21.48.1:80
ytmusicdownloader.us
CLOUDFLARENET
—
suspicious
4
System
192.168.100.255:138
—
—
—
whitelisted
4748
Setup.tmp
66.165.241.118:80
vtransmit.com
HVC-AS
US
unknown
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
ytmusicdownloader.us
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.96.1
unknown
vtransmit.com
  • 66.165.241.118
unknown
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.20
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.22
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.31
whitelisted
earphone.cf
  • 104.21.82.114
  • 172.67.201.190
unknown

Threats

PID
Process
Class
Message
5884
YoutubeMusicDownloader_Setup.tmp
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2200
svchost.exe
Misc activity
ET INFO DNS Query for Suspicious .cf Domain
5548
YoutubeMusicDownloader.exe
Potentially Bad Traffic
ET HUNTING Terse Request for .txt - Likely Hostile
5008
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
5008
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
YoutubeMusicDownloader_Setup.exe