URL:

http://falcoware.com/rk-distributives/FalcoImageStudioSetup.exe

Full analysis: https://app.any.run/tasks/f22e8dd2-1d2b-4255-88d4-0798a5438196
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 28, 2019, 08:30:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
innotools
Indicators:
MD5:

97430CB316ADDA3CF442AFD08DDFA0A5

SHA1:

E72F1095CDD36CED140EAF28F6CB58DD93FD6F47

SHA256:

FE7A2B9154322CADA775B53DAD09F47E251F0D4994A617AB29D0835C7B4046B4

SSDEEP:

3:N1KYDKSEXALdnBRTjgG4JQEh4A:CYtLhgpQEh4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • FalcoImageStudioSetup.exe (PID: 392)
      • FalcoImageStudioSetup.exe (PID: 3864)
      • vc_redist.x86.exe (PID: 3264)
      • Falco Image Studio.exe (PID: 2772)
      • rlservice.exe (PID: 2356)
      • rlvknlg.exe (PID: 2232)

    • INNOTOOLS was detected

      • FalcoImageStudioSetup.tmp (PID: 2280)

    • Downloads executable files from the Internet

      • opera.exe (PID: 2408)
      • FalcoImageStudioSetup.tmp (PID: 2280)

    • Connects to CnC server

      • FalcoImageStudioSetup.tmp (PID: 2280)

    • Loads dropped or rewritten executable

      • Falco Image Studio.exe (PID: 2772)
      • rlvknlg.exe (PID: 2232)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FalcoImageStudioSetup.exe (PID: 3864)
      • opera.exe (PID: 2408)
      • FalcoImageStudioSetup.exe (PID: 392)
      • FalcoImageStudioSetup.tmp (PID: 2280)
      • rkverify.exe (PID: 3432)
      • vc_redist.x86.exe (PID: 3264)
      • rkinstaller.exe (PID: 3268)
      • rlvknlg.exe (PID: 2232)

    • Reads the Windows organization settings

      • FalcoImageStudioSetup.tmp (PID: 2280)

    • Reads Windows owner or organization settings

      • FalcoImageStudioSetup.tmp (PID: 2280)

    • Executed via COM

      • unsecapp.exe (PID: 1812)

    • Creates files in the Windows directory

      • rlvknlg.exe (PID: 2232)

    • Searches for installed software

      • vc_redist.x86.exe (PID: 3264)

    • Uses NETSH.EXE for network configuration

      • rlvknlg.exe (PID: 2232)

    • Creates a software uninstall entry

      • rlvknlg.exe (PID: 2232)

    • Executed as Windows Service

      • rlservice.exe (PID: 2356)

    • Creates files in the program directory

      • rlvknlg.exe (PID: 2232)

  • INFO

    • Creates files in the user directory

      • opera.exe (PID: 2408)

    • Manual execution by user

      • FalcoImageStudioSetup.exe (PID: 3864)

    • Application was dropped or rewritten from another process

      • FalcoImageStudioSetup.tmp (PID: 444)
      • FalcoImageStudioSetup.tmp (PID: 2280)
      • rkverify.exe (PID: 3432)
      • rkinstaller.exe (PID: 3268)

    • Loads dropped or rewritten executable

      • FalcoImageStudioSetup.tmp (PID: 2280)
      • rkinstaller.exe (PID: 3268)

    • Creates a software uninstall entry

      • FalcoImageStudioSetup.tmp (PID: 2280)
      • rkinstaller.exe (PID: 3268)

    • Creates files in the program directory

      • rkinstaller.exe (PID: 3268)
      • FalcoImageStudioSetup.tmp (PID: 2280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
13
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start opera.exe falcoimagestudiosetup.exe falcoimagestudiosetup.tmp no specs falcoimagestudiosetup.exe #INNOTOOLS falcoimagestudiosetup.tmp rkverify.exe unsecapp.exe no specs rkinstaller.exe falco image studio.exe vc_redist.x86.exe rlvknlg.exe netsh.exe no specs rlservice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Users\admin\Desktop\FalcoImageStudioSetup.exe" /SPAWNWND=$301A0 /NOTIFYWND=$40192 C:\Users\admin\Desktop\FalcoImageStudioSetup.exe
FalcoImageStudioSetup.tmp
User:
admin
Company:
FalcoWare, Inc.
Integrity Level:
HIGH
Description:
Falco Image Studio Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\falcoimagestudiosetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
444"C:\Users\admin\AppData\Local\Temp\is-M4R5D.tmp\FalcoImageStudioSetup.tmp" /SL5="$40192,35570772,119808,C:\Users\admin\Desktop\FalcoImageStudioSetup.exe" C:\Users\admin\AppData\Local\Temp\is-M4R5D.tmp\FalcoImageStudioSetup.tmp—FalcoImageStudioSetup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-m4r5d.tmp\falcoimagestudiosetup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1812C:\Windows\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\system32\wbem\unsecapp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Sink to receive asynchronous callbacks for WMI client application
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\unsecapp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2232C:\Program Files\RelevantKnowledge\rlvknlg.exe -install -uninst:RelevantKnowledge -c:868 -t:FalcoImageStudio -bid:OFBsoNrwQEvqO7a67SH5d9 -o:0C:\Program Files\RelevantKnowledge\rlvknlg.exe
rkinstaller.exe
User:
admin
Company:
TMRG, Inc.
Integrity Level:
HIGH
Description:
Relevant-Knowledge
Exit code:
0
Version:
1.3.338.311 (Build 338.311)
Modules
Images
c:\program files\relevantknowledge\rlvknlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
2280"C:\Users\admin\AppData\Local\Temp\is-GFJ80.tmp\FalcoImageStudioSetup.tmp" /SL5="$5018A,35570772,119808,C:\Users\admin\Desktop\FalcoImageStudioSetup.exe" /SPAWNWND=$301A0 /NOTIFYWND=$40192 C:\Users\admin\AppData\Local\Temp\is-GFJ80.tmp\FalcoImageStudioSetup.tmp
FalcoImageStudioSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-gfj80.tmp\falcoimagestudiosetup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2356"C:\Program Files\RelevantKnowledge\rlservice.exe" /serviceC:\Program Files\RelevantKnowledge\rlservice.exe—services.exe
User:
SYSTEM
Company:
TMRG, Inc.
Integrity Level:
SYSTEM
Description:
Relevant-Knowledge
Exit code:
0
Version:
1.1.24.111 (Build 24.111)
Modules
Images
c:\program files\relevantknowledge\rlservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2408"C:\Program Files\Opera\opera.exe" "http://falcoware.com/rk-distributives/FalcoImageStudioSetup.exe"C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
2772"C:\Program Files\Falco Image Studio\Falco Image Studio.exe"C:\Program Files\Falco Image Studio\Falco Image Studio.exe
FalcoImageStudioSetup.tmp
User:
admin
Company:
Falco Software
Integrity Level:
MEDIUM
Description:
Falco Image Studio
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\falco image studio\falco image studio.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\falco image studio\victw32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3264"C:\Program Files\Falco Image Studio\vc_redist.x86.exe" /QC:\Program Files\Falco Image Studio\vc_redist.x86.exe
FalcoImageStudioSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
Exit code:
1638
Version:
14.0.23026.0
Modules
Images
c:\program files\falco image studio\vc_redist.x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3268"C:\Users\admin\AppData\Local\Temp\is-U0NCQ.tmp\rkinstaller.exe" -c:868 -t:FalcoImageStudioC:\Users\admin\AppData\Local\Temp\is-U0NCQ.tmp\rkinstaller.exe
FalcoImageStudioSetup.tmp
User:
admin
Company:
TMRG, INC.
Integrity Level:
HIGH
Description:
Relevant-Knowledge Installer
Exit code:
0
Version:
1.0.3.4 (Build 4)
Modules
Images
c:\users\admin\appdata\local\temp\is-u0ncq.tmp\rkinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 659
Read events
1 322
Write events
326
Delete events
11

Modification events

(PID) Process:(2408) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "http://falcoware.com/rk-distributives/FalcoImageStudioSetup.exe"
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
02000000070000000100000009000000080000000000000006000000030000000500000004000000FFFFFFFF
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:FFlags
Value:
1092616257
Executable files
34
Suspicious files
29
Text files
136
Unknown types
13

Dropped files

PID
Process
Filename
Type
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprAFE2.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprAFE3.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprB022.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00002.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\02JQOB2T43JJXZDU9PCG.temp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\Desktop\FalcoImageStudioSetup.exe —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\CACHEDIR.TAGtext
MD5:E717F92FA29AE97DBE4F6F5C04B7A3D9
SHA256:5BBD5DCBF87FD8CD7544C522BADF22A2951CF010AD9F25C40F9726F09EA2B552
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:—
SHA256:—
2280FalcoImageStudioSetup.tmpC:\Program Files\Falco Image Studio\is-5THVN.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
21
DNS requests
9
Threats
41

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2408
opera.exe
GET
200
45.10.111.18:80
http://falcoware.com/rk-distributives/FalcoImageStudioSetup.exe
unknown
executable
34.4 Mb
malicious
2772
Falco Image Studio.exe
GET
200
45.10.111.18:80
http://falcoware.com/updates/falcoimagestudio.info
unknown
text
53 b
malicious
2408
opera.exe
GET
400
107.167.110.211:80
http://sitecheck2.opera.com/?host=falcoware.com&hdn=EukFoHXzYq8dZ7QPrJGuZw==
US
html
150 b
whitelisted
2280
FalcoImageStudioSetup.tmp
POST
200
45.10.111.18:80
http://falcopartners.com/installed.php?pr=FalcoImageStudio
unknown
text
17 b
malicious
2280
FalcoImageStudioSetup.tmp
GET
200
165.193.78.234:80
http://post.securestudies.com/packages/RI1034/ContentI3.exe
US
executable
412 Kb
malicious
2280
FalcoImageStudioSetup.tmp
GET
200
165.193.78.234:80
http://post.securestudies.com/packages/RV0267/ContentV3.exe
US
executable
577 Kb
malicious
2408
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
564 b
whitelisted
2280
FalcoImageStudioSetup.tmp
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=868&tpi=FalcoImageStudio&action_id=4&uid=pZ_$abAb4$AE3zbHw55555
US
text
2 b
malicious
2280
FalcoImageStudioSetup.tmp
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=868&tpi=FalcoImageStudio&action_id=8&uid=pZ_$abAb4$AE3zbHw55555
US
text
2 b
malicious
2280
FalcoImageStudioSetup.tmp
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=868&tpi=FalcoImageStudio&action_id=1&uid=pZ_$abAb4$AE3zbHw55555
US
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2408
opera.exe
45.10.111.18:80
falcoware.com
—
—
malicious
2408
opera.exe
107.167.110.211:80
sitecheck2.opera.com
Opera Software Americas LLC
US
suspicious
2408
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
2408
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2280
FalcoImageStudioSetup.tmp
165.193.78.234:80
post.securestudies.com
Savvis
US
malicious
2280
FalcoImageStudioSetup.tmp
104.108.44.21:443
dpd.securestudies.com
Akamai Technologies, Inc.
NL
unknown
—
—
165.193.78.234:80
post.securestudies.com
Savvis
US
malicious
2280
FalcoImageStudioSetup.tmp
45.10.111.18:80
falcoware.com
—
—
malicious
3268
rkinstaller.exe
165.193.78.234:443
post.securestudies.com
Savvis
US
malicious
2772
Falco Image Studio.exe
45.10.111.18:80
falcoware.com
—
—
malicious

DNS requests

Domain
IP
Reputation
falcoware.com
  • 45.10.111.18
malicious
sitecheck2.opera.com
  • 107.167.110.211
  • 107.167.110.216
whitelisted
certs.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
post.securestudies.com
  • 165.193.78.234
malicious
dpd.securestudies.com
  • 104.108.44.21
whitelisted
falcopartners.com
  • 45.10.111.18
malicious
rules.securestudies.com
  • 205.217.169.104
unknown

Threats

PID
Process
Class
Message
2408
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Download PE file
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Downloader
2280
FalcoImageStudioSetup.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Download PE file
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Downloader
2280
FalcoImageStudioSetup.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Downloader
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Downloader Check-in
2280
FalcoImageStudioSetup.tmp
Misc activity
ADWARE [PTsecurity] InnoTools Downloader
24 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://falcoware.com/rk-distributives/FalcoImageStudioSetup.exe