File name:

YoutubeMusicDownloader_Setup.exe

Full analysis: https://app.any.run/tasks/e8d40ac3-ef49-454c-ad1f-b5edc388b7ea
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 01, 2025, 03:15:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

5306D60D73C91708BCF336A0B75B8F13

SHA1:

B6CFF5EB75A2D02F1F93DA99524929CDB0733BB6

SHA256:

F52354B10224C8DA9523ED7D3186686C278196EE81D846E26A6243CD38718CC1

SSDEEP:

24576:6OZE0TtJzQ32uMi3ZL/TaaRWftxmyF7AmplUa8boO8VE2Lq:6wE0JJzQ32uMi3ZL7aaRWftxmypAm7Ur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • YoutubeMusicDownloader_Setup.exe (PID: 1752)
      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • Reads the Windows owner or organization settings

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.tmp (PID: 4748)

    • Reads security settings of Internet Explorer

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.tmp (PID: 4748)
      • YoutubeMusicDownloader.exe (PID: 5548)

    • Potential Corporate Privacy Violation

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)

    • Process requests binary or script from the Internet

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)

    • There is functionality for taking screenshot (YARA)

      • Setup.tmp (PID: 4748)

  • INFO

    • Checks supported languages

      • YoutubeMusicDownloader_Setup.exe (PID: 1752)
      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)
      • YoutubeMusicDownloader.exe (PID: 5548)
      • identity_helper.exe (PID: 1204)
      • identity_helper.exe (PID: 8096)

    • Create files in a temporary directory

      • YoutubeMusicDownloader_Setup.exe (PID: 1752)
      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • Reads the computer name

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • Setup.tmp (PID: 4748)
      • YoutubeMusicDownloader.exe (PID: 5548)
      • identity_helper.exe (PID: 8096)
      • identity_helper.exe (PID: 1204)

    • Checks proxy server information

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)
      • YoutubeMusicDownloader.exe (PID: 5548)
      • Setup.tmp (PID: 4748)

    • Process checks computer location settings

      • YoutubeMusicDownloader_Setup.tmp (PID: 5884)

    • Detects InnoSetup installer (YARA)

      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • Compiled with Borland Delphi (YARA)

      • Setup.exe (PID: 3888)
      • Setup.tmp (PID: 4748)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 4748)

    • The sample compiled with english language support

      • Setup.tmp (PID: 4748)

    • Application launched itself

      • msedge.exe (PID: 4080)
      • msedge.exe (PID: 5780)
      • msedge.exe (PID: 6400)
      • msedge.exe (PID: 6732)
      • msedge.exe (PID: 7484)

    • Creates a software uninstall entry

      • Setup.tmp (PID: 4748)

    • Reads Environment values

      • identity_helper.exe (PID: 1204)
      • identity_helper.exe (PID: 8096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: StubInstaller
FileDescription: StubInstaller Setup
FileVersion:
LegalCopyright:
ProductName: StubInstaller
ProductVersion: 1.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
188
Monitored processes
50
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start youtubemusicdownloader_setup.exe youtubemusicdownloader_setup.tmp setup.exe setup.tmp youtubemusicdownloader.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2192,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7ffc455bf208,0x7ffc455bf214,0x7ffc455bf220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=3380,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
1732"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=4956,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1752"C:\Users\admin\AppData\Local\Temp\YoutubeMusicDownloader_Setup.exe" C:\Users\admin\AppData\Local\Temp\YoutubeMusicDownloader_Setup.exe
explorer.exe
User:
admin
Company:
StubInstaller
Integrity Level:
MEDIUM
Description:
StubInstaller Setup
Exit code:
1
Version:
Modules
Images
c:\users\admin\appdata\local\temp\youtubemusicdownloader_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1828"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffc455bf208,0x7ffc455bf214,0x7ffc455bf220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2276"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2784,i,12685032439956154154,6718899689136648782,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3616,i,12685032439956154154,6718899689136648782,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4140,i,12685032439956154154,6718899689136648782,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2668"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=3380,i,12447964152949907685,14441824535473442930,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
Total events
10 412
Read events
10 333
Write events
79
Delete events
0

Modification events

(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
FC1600002689CF7236EADB01
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
6D9DBEAD3D13A9247BF578B0F33C1DA347C905DCC2492515EDBBDEFAC05F920B
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5884) YoutubeMusicDownloader_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
30
Suspicious files
313
Text files
103
Unknown types
3

Dropped files

PID
Process
Filename
Type
5884YoutubeMusicDownloader_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-TVA9J.tmp\Setup.exeexecutable
MD5:8FBCF2078A29D9D36942A76A6A10256C
SHA256:B81B9EDA2592762A8C3D61BCB2570F99BAD23AEA1B7CD3CA5E76242788D790FC
3888Setup.exeC:\Users\admin\AppData\Local\Temp\is-UHLED.tmp\Setup.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
1752YoutubeMusicDownloader_Setup.exeC:\Users\admin\AppData\Local\Temp\is-1UF2K.tmp\YoutubeMusicDownloader_Setup.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
4748Setup.tmpC:\Users\admin\AppData\Local\YouTubeDownloader\is-ADBEA.tmpexecutable
MD5:1852850DCCBEBDE17EFDFDA9E3789E9A
SHA256:515A9E10AA1ED492A0E9B3DA238D7DB8BD4B3F9256C4518C176B8E0641E2FFBD
4748Setup.tmpC:\Users\admin\AppData\Local\Temp\is-AATAK.tmp\GCountry.dllexecutable
MD5:7DB1FADA998E826763FB1E5C36C22EF3
SHA256:C13C247CA7A88EC6C54BA76FE3D7BACF3593F09E9E2253813155831DA013B8B9
5884YoutubeMusicDownloader_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-TVA9J.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4748Setup.tmpC:\Users\admin\AppData\Local\Temp\is-AATAK.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
4748Setup.tmpC:\Users\admin\AppData\Local\Temp\is-AATAK.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF17a681.TMP —
MD5:—
SHA256:—
6400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
107
DNS requests
149
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5884
YoutubeMusicDownloader_Setup.tmp
GET
302
104.21.48.1:80
http://ytmusicdownloader.us/download/updates/vcredist_x86.exe
unknown
—
—
unknown
5548
YoutubeMusicDownloader.exe
GET
200
104.21.82.114:80
http://earphone.cf/c.txt
unknown
—
—
unknown
5008
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:whCnixHSM-p0VVYTvlyBITeOmKg6SBn9Ot-RYR3EvOw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
5548
YoutubeMusicDownloader.exe
GET
200
143.204.102.122:80
http://d1c3qo5dp2qej9.cloudfront.net/php/alive.php
unknown
—
—
whitelisted
3392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5548
YoutubeMusicDownloader.exe
GET
200
143.204.102.122:80
http://d1c3qo5dp2qej9.cloudfront.net/php/update.php?m=a000b&s=0
unknown
—
—
whitelisted
632
msedge.exe
GET
—
66.165.241.118:80
http://streaming-audio-recorder.org/style.css
unknown
—
—
unknown
632
msedge.exe
GET
200
66.165.241.118:80
http://streaming-audio-recorder.org/?id=ymd
unknown
—
—
unknown
632
msedge.exe
GET
200
66.165.241.118:80
http://streaming-audio-recorder.org/images/logo.png
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5708
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5884
YoutubeMusicDownloader_Setup.tmp
104.21.48.1:80
ytmusicdownloader.us
CLOUDFLARENET
—
suspicious
4
System
192.168.100.255:138
—
—
—
whitelisted
4748
Setup.tmp
66.165.241.118:80
vtransmit.com
HVC-AS
US
unknown
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
ytmusicdownloader.us
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.96.1
unknown
vtransmit.com
  • 66.165.241.118
unknown
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.20
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.22
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.31
whitelisted
earphone.cf
  • 104.21.82.114
  • 172.67.201.190
unknown

Threats

PID
Process
Class
Message
5884
YoutubeMusicDownloader_Setup.tmp
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2200
svchost.exe
Misc activity
ET INFO DNS Query for Suspicious .cf Domain
5548
YoutubeMusicDownloader.exe
Potentially Bad Traffic
ET HUNTING Terse Request for .txt - Likely Hostile
5008
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
5008
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
YoutubeMusicDownloader_Setup.exe