File name:

xvi32-2.55-installer_fxQIf-1.exe

Full analysis: https://app.any.run/tasks/d8f03ece-ab20-4e2d-aa25-150e007534d9
Verdict: Malicious activity
Analysis date: October 08, 2023, 11:52:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F1D1014C2E889B04E9EDC64B2B4DB7B2

SHA1:

5F705E0547EC87C504544F0DEF1B5CBA7B46E652

SHA256:

FF6971849639474C27353958485E2BED35957501B8D5524A4F603BC410688AC8

SSDEEP:

49152:R7HeQqhlQ6NY3fcPK7dK6EmbB9UpdOhIfYpaT6lPxCpz8McdBEojBY2UIEQcN66I:Z+QqZ8fKmV2d8LaLcDEojBwsuWWFYi2X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • xvi32-2.55-installer_fxQIf-1.exe (PID: 612)
      • xvi32-2.55-installer_fxQIf-1.exe (PID: 1988)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

    • Reads settings of System Certificates

      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

    • Adds/modifies Windows certificates

      • xvi32-2.55-installer_fxQIf-1.exe (PID: 1988)

    • Reads the Internet Settings

      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

  • INFO

    • Create files in a temporary directory

      • xvi32-2.55-installer_fxQIf-1.exe (PID: 612)
      • xvi32-2.55-installer_fxQIf-1.exe (PID: 1988)
      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

    • Checks supported languages

      • xvi32-2.55-installer_fxQIf-1.exe (PID: 612)
      • xvi32-2.55-installer_fxQIf-1.exe (PID: 1988)
      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 1768)
      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

    • Reads the computer name

      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 1768)
      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

    • Application was dropped or rewritten from another process

      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 1768)
      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)

    • Reads the machine GUID from the registry

      • xvi32-2.55-installer_fxQIf-1.tmp (PID: 964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:06:03 10:09:11+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 89088
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 816.136.3785.7339
ProductVersionNumber: 816.136.3785.7339
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Softònic International SÀ
FileVersion: 816.136.3785.7339
LegalCopyright: ©2023 Softònic International SÀ
OriginalFileName:
ProductName: Softònic International SÀ
ProductVersion: 816.136.3785.7339
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start xvi32-2.55-installer_fxqif-1.exe no specs xvi32-2.55-installer_fxqif-1.tmp no specs xvi32-2.55-installer_fxqif-1.exe xvi32-2.55-installer_fxqif-1.tmp ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
592"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\System32\ntvdm.exe—xvi32-2.55-installer_fxQIf-1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
612"C:\Users\admin\AppData\Local\Temp\xvi32-2.55-installer_fxQIf-1.exe" C:\Users\admin\AppData\Local\Temp\xvi32-2.55-installer_fxQIf-1.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Softònic International SÀ
Exit code:
0
Version:
816.136.3785.7339
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\xvi32-2.55-installer_fxqif-1.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
964"C:\Users\admin\AppData\Local\Temp\is-1AHMS.tmp\xvi32-2.55-installer_fxQIf-1.tmp" /SL5="$90194,836075,831488,C:\Users\admin\AppData\Local\Temp\xvi32-2.55-installer_fxQIf-1.exe" /SPAWNWND=$90216 /NOTIFYWND=$80168 C:\Users\admin\AppData\Local\Temp\is-1AHMS.tmp\xvi32-2.55-installer_fxQIf-1.tmp
xvi32-2.55-installer_fxQIf-1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1ahms.tmp\xvi32-2.55-installer_fxqif-1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Users\admin\AppData\Local\Temp\is-0742I.tmp\xvi32-2.55-installer_fxQIf-1.tmp" /SL5="$80168,836075,831488,C:\Users\admin\AppData\Local\Temp\xvi32-2.55-installer_fxQIf-1.exe" C:\Users\admin\AppData\Local\Temp\is-0742I.tmp\xvi32-2.55-installer_fxQIf-1.tmp—xvi32-2.55-installer_fxQIf-1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0742i.tmp\xvi32-2.55-installer_fxqif-1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1988"C:\Users\admin\AppData\Local\Temp\xvi32-2.55-installer_fxQIf-1.exe" /SPAWNWND=$90216 /NOTIFYWND=$80168 C:\Users\admin\AppData\Local\Temp\xvi32-2.55-installer_fxQIf-1.exe
xvi32-2.55-installer_fxQIf-1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Softònic International SÀ
Exit code:
0
Version:
816.136.3785.7339
Modules
Images
c:\users\admin\appdata\local\temp\xvi32-2.55-installer_fxqif-1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
Total events
5 693
Read events
5 667
Write events
22
Delete events
4

Modification events

(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
1900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA662000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C60B000000010000001A0000004900530052004700200052006F006F007400200058003100000014000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E1D000000010000001000000073B6876195F5D18E048510422AEF04E309000000010000000C000000300A06082B06010505070301030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E80F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F6320000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
0400000001000000100000000CD2F9E0DA1773E9ED864DA5E370E74E0F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F63030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E809000000010000000C000000300A06082B060105050703011D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E0B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C61900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:
1
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
F2F3D15EB29BA451F949C6AEE20150BDAC74D529F7D46C0580387DE1970E36D7
(PID) Process:(964) xvi32-2.55-installer_fxQIf-1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
C4030000CA35A4FDDDF9D901
Executable files
2
Suspicious files
7
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\Local\Temp\is-LUK1R.tmp\is-CUPSJ.tmpimage
MD5:5EF5291810C454A35F76D976105F37CC
SHA256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\Local\Temp\is-LUK1R.tmp\AVG_AV.pngimage
MD5:5EF5291810C454A35F76D976105F37CC
SHA256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
1988xvi32-2.55-installer_fxQIf-1.exeC:\Users\admin\AppData\Local\Temp\is-1AHMS.tmp\xvi32-2.55-installer_fxQIf-1.tmpexecutable
MD5:E19EE21B0249A79BAF781C0BE0BB9BF8
SHA256:D24F26374FAC5BCDB3D3391E8406A7FCD6E17B7CD1A4BE5792352403C90A6D5B
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\Local\Temp\Cab3775.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\Local\Temp\Tar3776.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\Local\Temp\is-LUK1R.tmp\mainlogo.gifimage
MD5:01408AE6964CE3F633B0FD76880ECAD6
SHA256:BCF6A2CE1FB470F2B5F5E422E8DB4CBFF9E9496F209337A6747659F914BE7F38
612xvi32-2.55-installer_fxQIf-1.exeC:\Users\admin\AppData\Local\Temp\is-0742I.tmp\xvi32-2.55-installer_fxQIf-1.tmpexecutable
MD5:E19EE21B0249A79BAF781C0BE0BB9BF8
SHA256:D24F26374FAC5BCDB3D3391E8406A7FCD6E17B7CD1A4BE5792352403C90A6D5B
964xvi32-2.55-installer_fxQIf-1.tmpC:\Users\admin\AppData\Local\Temp\is-LUK1R.tmp\is-LJTC6.tmpimage
MD5:01408AE6964CE3F633B0FD76880ECAD6
SHA256:BCF6A2CE1FB470F2B5F5E422E8DB4CBFF9E9496F209337A6747659F914BE7F38
592ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsF0F2.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
964
xvi32-2.55-installer_fxQIf-1.tmp
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e3a1e7f80b70fc8a
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
964
xvi32-2.55-installer_fxQIf-1.tmp
52.222.232.34:443
d2lss4haxviibi.cloudfront.net
AMAZON-02
US
unknown
964
xvi32-2.55-installer_fxQIf-1.tmp
23.67.132.99:443
images.sftcdn.net
AKAMAI-AS
DE
unknown
964
xvi32-2.55-installer_fxQIf-1.tmp
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
964
xvi32-2.55-installer_fxQIf-1.tmp
151.139.128.10:443
gsf-sp.softonic.com
STACKPATH-CDN
US
unknown

DNS requests

Domain
IP
Reputation
d2lss4haxviibi.cloudfront.net
  • 52.222.232.34
  • 52.222.232.59
  • 52.222.232.47
  • 52.222.232.130
unknown
images.sftcdn.net
  • 23.67.132.99
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
gsf-sp.softonic.com
  • 151.139.128.10
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xvi32-2.55-installer_fxQIf-1.exe