INSIDE_V2.0.0_Windows_Installer.exePE analysis report - Malicious
Run integrity
sample ranThe guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.
35.4sto launch
547telemetry events
292observed
91agent notes
Malicious
78/100
8 points past the malicious line at 70.
Clean0-34
Suspicious35-69
Malicious70-100
Why this verdict
+47
Static analysis
- Packed (Inno Setup, confidence 61)
- 2 high-risk capability(ies): sandbox evasion, token manipulation
- 4 supporting capabilities in one unsigned binary: file discovery, obfuscation, registry query, system information
- 1 high-risk capability bucket(s): Privilege escalation
- Local ML score 82.5
+17
Runtime behavior
- 1 evasion behavior(s)
- timestomping
+14
Persistence
- 1 persistence mechanism(s): Shell Open Command Hijack
+0
Model review
- findings review (advisory, not scored): suspicious - anti-analysis checks, timestomping, shell open command hijack, packed unsigned installer
Model reading
Measured
MALICIOUS78 of 100
Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.
Model reads it asadvisory, no points
NOT ASSESSEDnot shown on this page
Reads this report's derived findings, never the sample itself.
A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.
Analysis layers
Static
ran
moved the score
Dynamic
ran
moved the score
Threat intel
local feeds only
no points
AI
not included
Detection signatures
12 detected · 6 withheld as common| Severity | Detection | Evidence | Layer |
|---|---|---|---|
| MED |
Creates a suspended process then resumes (hollowing/hijack)
MITRE T1055.012
|
import
kernel32.dll!CreateProcessW
requires createprocess
import
kernel32.dll!ResumeThread
requires resumethread
|
static |
| MED |
Evasion: anti debug
MITRE T1497
|
runtime
anti debug
evasion signal
|
dynamic |
| MED |
Forces reboot/shutdown (post-impact)
MITRE T1529
|
import
user32.dll!ExitWindowsEx
|
static |
| MED |
Packed with Inno Setup
MITRE T1027.002
|
packer
Inno Setup
packer identification
entropy
7.95
file entropy (8.0 = random)
|
static |
| MED |
TLS callback (pre-main execution)
MITRE T1055
|
pe_header
IMAGE_DIRECTORY_ENTRY_TLS present
callbacks run before the entry point
|
static |
| MED |
Timestomping
|
runtime
timestomping
observed in the guest
|
dynamic |
| LOW |
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
|
import
advapi32.dll!AdjustTokenPrivileges
|
static |
| LOW |
Checks free disk space (sandbox sizing check)
MITRE T1497.001
seen in 6% of benign software
|
import
kernel32.dll!GetDiskFreeSpaceW
|
static |
| LOW |
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
|
import
kernel32.dll!VirtualProtect
requires virtualprotect
import
kernel32.dll!VirtualAlloc
requires virtualalloc
|
static |
| LOW |
Reflective/manual DLL load pattern
MITRE T1620
seen in 8% of benign software
|
import
kernel32.dll!VirtualAlloc
requires virtualalloc
import
kernel32.dll!GetProcAddress
requires getprocaddress
import
kernel32.dll!LoadLibraryA
requires loadlibrary
import
kernel32.dll!CreateThread
requires createthread
|
static |
| LOW |
Scans memory layout (VirtualQuery)
MITRE T1055
|
import
kernel32.dll!VirtualQueryEx
|
static |
| LOW |
Spawns child processes
MITRE T1106
seen in 16% of benign software
|
import
kernel32.dll!CreateProcessW
|
static |
Withheld: 6 rules fired and were not reported above
These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.
Timing-based anti-analysis (QueryPerformanceCounter/rdtsc)
fires on 92% of benign software
Dynamic API resolution (obfuscation)
fires on 65% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress)
fires on 49% of benign software
Reads its own startup info (parent/desktop check)
fires on 36% of benign software
Executes external code / commands
fires on 30% of benign software
Queries system information (host recon)
fires on 25% of benign software
Persistence
1 mechanism
HIGH
Shell Open Command Hijack runtime
Execution Hijack · MITRE T1546.001
Auto-start methods established during detonation or referenced statically. The Persistence tab lists these against every method checked.
What the tests returned
5 testsEach test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.
| Test | Result |
|---|---|
| Cross-process injection | none observed |
| Network connections | the capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case |
| Behavioural rule matches (Sigma) | none observed |
| Known-malicious hash (reputation sources) | no source reported this file |
| Local anti-virus engine | reported no detection |
Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.
Arguing against malice
- The local anti-virus engine reported no detection.
- No reputation source reported this file as malicious.
How much weight this carries
Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: persistence established at runtime.
Instrument coverage
3 of 4 measuredWhat this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.
| Layer | Ran | What that means |
|---|---|---|
| Runtime anti-analysis watch | measured | Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing. |
| API call sequence | measured | Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else. |
| Explicit module loads | measured | Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts. |
| Network capture | not on this plan | Not included on this scan's plan. |
| Live kernel introspection | not measured | Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop. |
This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: signature rules, detected capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Signature
Inno Setup Module(6.1.0)[unicode]
CompilerEmbarcadero Delphi(10.3 Rio)[Professional]
LinkerTurbo Linker(2.25*,Delphi)[GUI32]
InstallerInno Setup Module(6.1.0)[unicode]
Identity
File
typeexecutable
size10.9 MB
file arch32-bit (x86)
subsystemGUI
entropy7.9535
date2023-02-15 14:54:16 UTC
version2.0.0.4
descriptionУÑÑановÑик INSIDE V2.0
productINSIDE V2.0
languageEN, NEU
Antivirus engine
no signature matched signature set 28160 - 3.6M signaturesNothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.
| Signature set | Value |
|---|---|
| Set version | 28160 |
| Signatures in the set | 3,642,883 |
| Set published | 21 Oct 2026 06:25 +0000 |
| Age when this file was scanned | same day |
A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.
Local ML assessment
82.5 of 100 8 strongest of 2568 featuresA gradient-boosted model running entirely on this host scored this file 82.5 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.
Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.
| Structural feature | What it means | Pushes | Weight |
|---|---|---|---|
| parser warning: Suspicious flags set for section... | Header defect reported by the parse: Suspicious flags set for section... (0) | towards benign | -0.6822 |
| image flag dll | Image flag: a library rather than a program | towards malicious | +0.4540 |
| resource directory size | Size of the resource table (380032) | towards benign | -0.3957 |
| optional.checksum | Header checksum, which is zero on most files that were never signed (0) | towards malicious | +0.3535 |
| feature column 2478 | When a timestamp authority countersigned the signature | towards malicious | +0.2793 |
| feature column 993 | Byte randomness of the data appended after the last section | towards benign | -0.2696 |
| image flag relocs_stripped | Image flag: relocations stripped | towards malicious | +0.2567 |
| import comctl32.dll:InitCommonControls | Calls InitCommonControls from comctl32.dll | towards benign | -0.2364 |
A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.
Packing
Packed with Inno Setup
Packed code is compressed or encrypted on disk and only appears once the sample runs.
61/100
packer confidence
Detonation is the reliable read here
A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.
Evidence 4 signals
- Packer section '.didata' (Inno Setup)
- High-entropy resource (possible packed payload)
- Marker 'Inno Setup' (Inno Setup)
- TLS callback present
Family configuration search
Incomplete1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.
| Parsers available | 69 |
|---|---|
| Returned a result | 2 |
| Failed to decode | 1 |
Capabilities
7 behaviour buckets · 1 high-risk| Severity | Capability | MITRE | APIs |
|---|---|---|---|
| high | Privilege escalation Adjusts tokens / privileges |
T1134, T1134.001 | adjusttokenprivileges, openprocesstoken |
| med | Code execution Creates processes / runs commands or shellcode |
T1059, T1106 | createprocessw, createthread, system |
| med | Evasion / stalling Sleeps, times, or otherwise stalls analysis |
T1497.003 | gettickcount, queryperformancecounter, sleep |
| med | Dynamic API resolution Resolves APIs at runtime (obfuscation) |
T1129 | getprocaddress, loadlibrarya, loadlibraryw |
| med | Ransomware behaviour Enumerates + encrypts files, deletes backups |
T1083 | findfirstfilew |
| med | System shutdown / reboot Reboots or shuts down the host |
T1529 | exitwindowsex |
| low | Discovery Enumerates the host, users, processes or network |
T1082 | getsysteminfo, netwkstagetinfo |
Security mitigations
partial posture
ON
ASLR (DynamicBase)
OFF
High-entropy ASLR (64-bit)
ON
DEP / NX (NxCompat)
OFF
Control Flow Guard
?
SafeSEH
?
Stack cookies (GS)
OFF
Force Integrity
OFF
AppContainer isolation
OFF
Authenticode signed
Sections
10 sections · the file's memory layout| Section | Virtual addr | Raw size | Virtual size | Access | Entropy |
|---|---|---|---|---|---|
|
.text
Executable code
|
0x1000 |
718.5 KB
|
718.5 KB
|
EXECUTEREAD
|
6.3576
|
|
.itextEP
Initialisation code
|
0xb5000 |
6.0 KB
|
5.6 KB
|
EXECUTEREAD
|
5.9714
|
|
.data
Initialised data
|
0xb7000 |
14.0 KB
|
13.9 KB
|
READWRITE
|
5.0486
|
|
.bss
Uninitialised data
|
0xbb000 |
0.0 B
|
27.5 KB
|
READWRITE
|
0.0
|
|
.idata
Import table
|
0xc2000 |
4.0 KB
|
4.0 KB
|
READWRITE
|
5.0291
|
|
.didata
Non-standard section
|
0xc3000 |
512.0 B
|
420.0 B
|
READWRITE
|
2.751
|
|
.edata
Export table
|
0xc4000 |
512.0 B
|
154.0 B
|
READ
|
1.8772
|
|
.tls
Thread-local storage
|
0xc5000 |
0.0 B
|
24.0 B
|
READWRITE
|
0.0
|
|
.rdata
Read-only data
|
0xc6000 |
512.0 B
|
93.0 B
|
READ
|
1.3839
|
|
.rsrc
Resources
|
0xc7000 |
371.5 KB
|
371.1 KB
|
READ
|
5.9709
|
code
data
imports/exports
resources
metadata
packer
non-standard
Entropy above 7.0 means compressed or encrypted content.
Imports
142 funcs / 7 DLLs · 13 suspicious▸kernel32.dll100 funcs 10 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| GetACP | 0x000c22f4 | - | - |
| GetExitCodeProcess | 0x000c22f8 | - | - |
| LocalFree | 0x000c22fc | - | - |
| CloseHandle | 0x000c2300 | - | - |
| SizeofResource | 0x000c2304 | - | - |
| VirtualProtect | 0x000c2308 | - | T1055 |
| VirtualFree | 0x000c230c | - | - |
| GetFullPathNameW | 0x000c2310 | - | - |
| ExitProcess | 0x000c2314 | - | - |
| HeapAlloc | 0x000c2318 | - | - |
| GetCPInfoExW | 0x000c231c | - | - |
| RtlUnwind | 0x000c2320 | yes | - |
| GetCPInfo | 0x000c2324 | - | - |
| GetStdHandle | 0x000c2328 | - | - |
| GetModuleHandleW | 0x000c232c | - | - |
| FreeLibrary | 0x000c2330 | - | - |
| HeapDestroy | 0x000c2334 | - | - |
| ReadFile | 0x000c2338 | - | - |
| CreateProcessW | 0x000c233c | - | T1106 |
| GetLastError | 0x000c2340 | - | - |
| GetModuleFileNameW | 0x000c2344 | - | - |
| SetLastError | 0x000c2348 | - | - |
| FindResourceW | 0x000c234c | - | - |
| CreateThread | 0x000c2350 | - | - |
| CompareStringW | 0x000c2354 | - | - |
| LoadLibraryA | 0x000c2358 | - | T1129 |
| ResetEvent | 0x000c235c | - | - |
| GetVersion | 0x000c2360 | - | - |
| RaiseException | 0x000c2364 | - | - |
| FormatMessageW | 0x000c2368 | - | - |
| SwitchToThread | 0x000c236c | - | - |
| GetExitCodeThread | 0x000c2370 | - | - |
| GetCurrentThread | 0x000c2374 | - | - |
| LoadLibraryExW | 0x000c2378 | - | - |
| LockResource | 0x000c237c | - | - |
| GetCurrentThreadId | 0x000c2380 | - | - |
| UnhandledExceptionFilter | 0x000c2384 | - | - |
| VirtualQuery | 0x000c2388 | - | - |
| VirtualQueryEx | 0x000c238c | - | - |
| Sleep | 0x000c2390 | - | - |
| EnterCriticalSection | 0x000c2394 | - | - |
| SetFilePointer | 0x000c2398 | - | - |
| LoadResource | 0x000c239c | - | T1129 |
| SuspendThread | 0x000c23a0 | - | - |
| GetTickCount | 0x000c23a4 | - | T1497 |
| GetFileSize | 0x000c23a8 | - | - |
| GetStartupInfoW | 0x000c23ac | - | - |
| GetFileAttributesW | 0x000c23b0 | - | - |
| InitializeCriticalSection | 0x000c23b4 | - | - |
| GetSystemWindowsDirectoryW | 0x000c23b8 | - | - |
| GetThreadPriority | 0x000c23bc | - | - |
| SetThreadPriority | 0x000c23c0 | - | - |
| GetCurrentProcess | 0x000c23c4 | - | - |
| VirtualAlloc | 0x000c23c8 | - | T1055 |
| GetSystemInfo | 0x000c23cc | - | - |
| GetCommandLineW | 0x000c23d0 | - | - |
| LeaveCriticalSection | 0x000c23d4 | - | - |
| GetProcAddress | 0x000c23d8 | - | T1129 |
| ResumeThread | 0x000c23dc | - | - |
| GetVersionExW | 0x000c23e0 | - | - |
| VerifyVersionInfoW | 0x000c23e4 | - | - |
| HeapCreate | 0x000c23e8 | - | - |
| GetWindowsDirectoryW | 0x000c23ec | - | - |
| VerSetConditionMask | 0x000c23f0 | - | - |
| GetDiskFreeSpaceW | 0x000c23f4 | - | - |
| FindFirstFileW | 0x000c23f8 | - | T1083 |
| GetUserDefaultUILanguage | 0x000c23fc | - | - |
| lstrlenW | 0x000c2400 | - | - |
| QueryPerformanceCounter | 0x000c2404 | - | T1497 |
| SetEndOfFile | 0x000c2408 | - | - |
| HeapFree | 0x000c240c | - | - |
| WideCharToMultiByte | 0x000c2410 | - | - |
| FindClose | 0x000c2414 | - | - |
| MultiByteToWideChar | 0x000c2418 | - | - |
| LoadLibraryW | 0x000c241c | - | T1129 |
| SetEvent | 0x000c2420 | - | - |
| CreateFileW | 0x000c2424 | - | - |
| GetLocaleInfoW | 0x000c2428 | - | - |
| GetSystemDirectoryW | 0x000c242c | - | - |
| DeleteFileW | 0x000c2430 | - | - |
| GetLocalTime | 0x000c2434 | - | - |
| GetEnvironmentVariableW | 0x000c2438 | - | - |
| WaitForSingleObject | 0x000c243c | - | - |
| WriteFile | 0x000c2440 | - | - |
| ExitThread | 0x000c2444 | - | - |
| DeleteCriticalSection | 0x000c2448 | - | - |
| TlsGetValue | 0x000c244c | - | - |
| GetDateFormatW | 0x000c2450 | - | - |
| SetErrorMode | 0x000c2454 | - | - |
| IsValidLocale | 0x000c2458 | - | - |
| TlsSetValue | 0x000c245c | - | - |
| CreateDirectoryW | 0x000c2460 | - | - |
| GetSystemDefaultUILanguage | 0x000c2464 | - | - |
| EnumCalendarInfoW | 0x000c2468 | - | - |
| LocalAlloc | 0x000c246c | - | - |
| GetUserDefaultLangID | 0x000c2470 | - | - |
| RemoveDirectoryW | 0x000c2474 | - | - |
| CreateEventW | 0x000c2478 | - | - |
| SetThreadLocale | 0x000c247c | - | - |
| GetThreadLocale | 0x000c2480 | - | - |
▸comctl32.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| InitCommonControls | 0x000c2488 | - | - |
▸version.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| GetFileVersionInfoSizeW | 0x000c2490 | - | - |
| VerQueryValueW | 0x000c2494 | - | - |
| GetFileVersionInfoW | 0x000c2498 | - | - |
▸user32.dll16 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CreateWindowExW | 0x000c24a0 | - | - |
| TranslateMessage | 0x000c24a4 | - | - |
| CharLowerBuffW | 0x000c24a8 | - | - |
| CallWindowProcW | 0x000c24ac | - | - |
| CharUpperW | 0x000c24b0 | - | - |
| PeekMessageW | 0x000c24b4 | - | - |
| GetSystemMetrics | 0x000c24b8 | - | - |
| SetWindowLongW | 0x000c24bc | - | - |
| MessageBoxW | 0x000c24c0 | - | - |
| DestroyWindow | 0x000c24c4 | - | - |
| CharUpperBuffW | 0x000c24c8 | - | - |
| CharNextW | 0x000c24cc | - | - |
| MsgWaitForMultipleObjects | 0x000c24d0 | - | - |
| LoadStringW | 0x000c24d4 | - | - |
| ExitWindowsEx | 0x000c24d8 | - | - |
| DispatchMessageW | 0x000c24dc | - | - |
▸oleaut32.dll11 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SysAllocStringLen | 0x000c24e4 | - | - |
| SafeArrayPtrOfIndex | 0x000c24e8 | - | - |
| VariantCopy | 0x000c24ec | - | - |
| SafeArrayGetLBound | 0x000c24f0 | - | - |
| SafeArrayGetUBound | 0x000c24f4 | - | - |
| VariantInit | 0x000c24f8 | - | - |
| VariantClear | 0x000c24fc | - | - |
| SysFreeString | 0x000c2500 | - | - |
| SysReAllocStringLen | 0x000c2504 | - | - |
| VariantChangeType | 0x000c2508 | - | - |
| SafeArrayCreate | 0x000c250c | - | - |
▸netapi32.dll2 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| NetWkstaGetInfo | 0x000c2514 | - | - |
| NetApiBufferFree | 0x000c2518 | - | - |
▸advapi32.dll9 funcs 3 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ConvertStringSecurityDescriptorToSecurityDescriptorW | 0x000c2520 | - | - |
| RegQueryValueExW | 0x000c2524 | - | - |
| AdjustTokenPrivileges | 0x000c2528 | - | T1134 |
| GetTokenInformation | 0x000c252c | - | - |
| ConvertSidToStringSidW | 0x000c2530 | - | - |
| LookupPrivilegeValueW | 0x000c2534 | - | T1134 |
| RegCloseKey | 0x000c2538 | - | - |
| OpenProcessToken | 0x000c253c | - | T1134 |
| RegOpenKeyExW | 0x000c2540 | - | - |
Binary metadata
what the headers declare about this build| Resource langs | ENNEU |
|---|---|
| Debug info | no |
| TLS callbacks | yes |
Code signing
UnsignedThis binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.
Resources
Everything the binary carries inside it: icons, bitmaps, cursors, dialogs, string tables, the manifest and the version block. Select an entry to preview it and take a copy.
Resources
Resource Hacker view
Group Icon1Icon9Manifest1RCData3String Table11Version Info1
▸Group Icon1
MAINICONEN
▸Icon9
100EN
101EN
102EN
103EN
104EN
105EN
106EN
107EN
108EN
▸Manifest1
1EN
▸RCData3
DVCLALNEU
PACKAGEINFONEU
11111NEU
▸String Table11
4086NEU
4087NEU
4088NEU
4089NEU
4090NEU
4091NEU
4092NEU
4093NEU
4094NEU
4095NEU
4096NEU
▸Version Info1
1EN
Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.
Group Icon MAINICON
Download
| Type | Group Icon |
|---|---|
| Name / ID | MAINICON |
| Language | EN |
| Size | 132.0 B |
| RVA offset | 0x122ed0 |
| Content signature | Icon |
| MD5 | c65cc522ce6fffcbe3e4db7c69500ea4 |
| Entropy | 3.179 |
Icon 100
Download
| Type | Icon |
|---|---|
| Name / ID | 100 |
| Language | EN |
| Size | 1.1 KB |
| RVA offset | 0xc75b8 |
| Content signature | Icon |
| MD5 | 775c08ae1fbbd46fc21ba131f77e4d2c |
| Entropy | 6.617 |
Icon 101
Download
| Type | Icon |
|---|---|
| Name / ID | 101 |
| Language | EN |
| Size | 2.4 KB |
| RVA offset | 0xc7a20 |
| Content signature | Icon |
| MD5 | 93296920ee02d35d36f9cf975736be88 |
| Entropy | 6.25 |
Icon 102
Download
| Type | Icon |
|---|---|
| Name / ID | 102 |
| Language | EN |
| Size | 4.2 KB |
| RVA offset | 0xc83a8 |
| Content signature | Icon |
| MD5 | 9ca2131e9821304f70034bb8a6762c44 |
| Entropy | 6.245 |
Icon 103
Download
| Type | Icon |
|---|---|
| Name / ID | 103 |
| Language | EN |
| Size | 9.4 KB |
| RVA offset | 0xc9450 |
| Content signature | Icon |
| MD5 | d19bdbaea11772b3e7c6bf5a727ead5a |
| Entropy | 5.721 |
Icon 104
Download
| Type | Icon |
|---|---|
| Name / ID | 104 |
| Language | EN |
| Size | 16.5 KB |
| RVA offset | 0xcb9f8 |
| Content signature | Icon |
| MD5 | 004ec609fb39507dc00c028cb8809511 |
| Entropy | 5.516 |
Icon 105
Download
| Type | Icon |
|---|---|
| Name / ID | 105 |
| Language | EN |
| Size | 37.2 KB |
| RVA offset | 0xcfc20 |
| Content signature | Icon |
| MD5 | 6bcdd9a9493a4741280480e37502644e |
| Entropy | 5.303 |
Icon 106
Download
| Type | Icon |
|---|---|
| Name / ID | 106 |
| Language | EN |
| Size | 66.0 KB |
| RVA offset | 0xd90c8 |
| Content signature | Icon |
| MD5 | 186fcfc1f98882be2686ed9cee9c0525 |
| Entropy | 5.2 |
Icon 107
Download
| Type | Icon |
|---|---|
| Name / ID | 107 |
| Language | EN |
| Size | 148.5 KB |
| RVA offset | 0xe98f0 |
| Content signature | Icon |
| MD5 | 8ebc92242d192dcbc12e9c53bf7cb599 |
| Entropy | 4.982 |
Icon 108
Download
| Type | Icon |
|---|---|
| Name / ID | 108 |
| Language | EN |
| Size | 72.3 KB |
| RVA offset | 0x10eb18 |
| Content signature | PNG |
| MD5 | 69d1f6b007d61f849a7f1aca2813ac39 |
| Entropy | 7.988 |
Manifest 1
Download
| Type | Manifest |
|---|---|
| Name / ID | 1 |
| Language | EN |
| Size | 1.9 KB |
| RVA offset | 0x1234d8 |
| Content signature | XML manifest |
| MD5 | e07ab8c9030f776ce0f6d9040d41c616 |
| Entropy | 4.891 |
Application manifest
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
name="JR.Inno.Setup"
processorArchitecture="x86"
version="1.0.0.0"
type="win32"/>
<description>Inno Setup</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
</application>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<file name="comctl32.dll" loadFrom="%SystemRoot%\system32\" />
<file name="mpr.dll" loadFrom="%SystemRoot%\system32\" />
<file name="netapi32.dll" loadFrom="%SystemRoot%\system32\" />
<file name="netutils.dll" loadFrom="%SystemRoot%\system32\" />
<file name="textshaping.dll" loadFrom="%SystemRoot%\system32\" />
<file name="version.dll" loadFrom="%SystemRoot%\system32\" />
<file name="winhttp.dll" loadFrom="%SystemRoot%\system32\" />
</assembly>
RCData DVCLAL
Download
| Type | RCData |
|---|---|
| Name / ID | DVCLAL |
| Language | NEU |
| Size | 16.0 B |
| RVA offset | 0x122bd0 |
| Content signature | RCData |
| MD5 | a40263c75fde7440b1086b7da9c51fc2 |
| Entropy | 4.0 |
RCData PACKAGEINFO
Download
| Type | RCData |
|---|---|
| Name / ID | PACKAGEINFO |
| Language | NEU |
| Size | 708.0 B |
| RVA offset | 0x122be0 |
| Content signature | RCData |
| MD5 | def52a5b1e8bba58fe020b2c959f5c4f |
| Entropy | 5.205 |
RCData 11111
Download
| Type | RCData |
|---|---|
| Name / ID | 11111 |
| Language | NEU |
| Size | 44.0 B |
| RVA offset | 0x122ea4 |
| Content signature | RCData |
| MD5 | b339993a756a8bd5c42517ce9c06fb6e |
| Entropy | 4.659 |
String Table 4086
Download
| Type | String Table |
|---|---|
| Name / ID | 4086 |
| Language | NEU |
| Size | 864.0 B |
| RVA offset | 0x120c68 |
| Content signature | String Table |
| MD5 | 98da6167be9a4eb3be8bab5877938ff2 |
| Entropy | 3.166 |
String Table 4087
Download
| Type | String Table |
|---|---|
| Name / ID | 4087 |
| Language | NEU |
| Size | 608.0 B |
| RVA offset | 0x120fc8 |
| Content signature | String Table |
| MD5 | 21cba6c9d478ce13ad53587cdd7f21f8 |
| Entropy | 3.409 |
String Table 4088
Download
| Type | String Table |
|---|---|
| Name / ID | 4088 |
| Language | NEU |
| Size | 1.1 KB |
| RVA offset | 0x121228 |
| Content signature | String Table |
| MD5 | 09208f24be8c3f3b08c323e9836db5e6 |
| Entropy | 3.312 |
String Table 4089
Download
| Type | String Table |
|---|---|
| Name / ID | 4089 |
| Language | NEU |
| Size | 1.0 KB |
| RVA offset | 0x121684 |
| Content signature | String Table |
| MD5 | aeb11111a0334d20d978e15c3eb3ebab |
| Entropy | 3.34 |
String Table 4090
Download
| Type | String Table |
|---|---|
| Name / ID | 4090 |
| Language | NEU |
| Size | 724.0 B |
| RVA offset | 0x121a90 |
| Content signature | String Table |
| MD5 | d2467f70311fc072d9202909bdfa9fcb |
| Entropy | 3.367 |
String Table 4091
Download
| Type | String Table |
|---|---|
| Name / ID | 4091 |
| Language | NEU |
| Size | 184.0 B |
| RVA offset | 0x121d64 |
| Content signature | String Table |
| MD5 | e8e4995b464abd85d77008d3750ca7af |
| Entropy | 3.34 |
String Table 4092
Download
| Type | String Table |
|---|---|
| Name / ID | 4092 |
| Language | NEU |
| Size | 156.0 B |
| RVA offset | 0x121e1c |
| Content signature | String Table |
| MD5 | d0969cc9a96275d54a109de740708a5a |
| Entropy | 3.154 |
String Table 4093
Download
| Type | String Table |
|---|---|
| Name / ID | 4093 |
| Language | NEU |
| Size | 884.0 B |
| RVA offset | 0x121eb8 |
| Content signature | String Table |
| MD5 | 4ac29bb5f7361e85771807112cd4ec93 |
| Entropy | 3.319 |
String Table 4094
Download
| Type | String Table |
|---|---|
| Name / ID | 4094 |
| Language | NEU |
| Size | 920.0 B |
| RVA offset | 0x12222c |
| Content signature | String Table |
| MD5 | 110abe16232608d8671eaca8ee324f45 |
| Entropy | 3.288 |
String Table 4095
Download
| Type | String Table |
|---|---|
| Name / ID | 4095 |
| Language | NEU |
| Size | 872.0 B |
| RVA offset | 0x1225c4 |
| Content signature | String Table |
| MD5 | 1c9252919f0a0d2072f3fe0565f0b443 |
| Entropy | 3.334 |
String Table 4096
Download
| Type | String Table |
|---|---|
| Name / ID | 4096 |
| Language | NEU |
| Size | 676.0 B |
| RVA offset | 0x12292c |
| Content signature | String Table |
| MD5 | d1efb0d972603f09c3a2a866a8b36d48 |
| Entropy | 3.293 |
Version Info 1
Download
| Type | Version Info |
|---|---|
| Name / ID | 1 |
| Language | EN |
| Size | 1.4 KB |
| RVA offset | 0x122f54 |
| Content signature | Version Info |
| MD5 | 3f7eb473ce84700a38b659b6b9bb5513 |
| Entropy | 2.643 |
Parsed version info
| Comments | This installation was built with Inno Setup. |
|---|---|
| CompanyName | HPV TEAM |
| FileVersion | 2.0.0.4 |
| ProductName | INSIDE V2.0 |
| LegalCopyright | |
| ProductVersion | 2.0 |
| FileDescription | УÑÑановÑик INSIDE V2.0 |
| OriginalFileName |
Similar samples
4 related samplesRanked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.
| Relation | Sample | Verdict | Why it matched |
|---|---|---|---|
| variant | fsrdemoing.exe | Suspicious | TLSH distance 60 · identical export table (exphash) |
| related | Setup_BrightSlide_1.1.2.exe | No threats detected | identical import table (imphash) · identical export table (exphash) |
| related | AutoFishing.exe | Suspicious | identical export table (exphash) |
| related | afterpatch.exe | No threats detected | identical export table (exphash) |
Capability detection
50 capabilities
list is incomplete here
The capability analysis reports that this file is an installer, so the capabilities below are mostly its installer stub's, not the payload's.
Read what follows as the capabilities of the code that could be read, not of the file as a whole.
| Capability | Namespace |
|---|---|
| link function at runtime on Windows | linking/runtime-linking |
| calculate modulo 256 via x86 assembly | - |
| create or open file | - |
| modify access privileges | host-interaction/process/modify |
| create process on Windows | host-interaction/process/create |
| allocate memory | - |
| allocate or change RW memory | - |
| delay execution | - |
| generate random numbers using the Delphi LCG | data-manipulation/prng/lcg |
| create thread | host-interaction/thread/create |
| create or open registry key | - |
| get file attributes | host-interaction/file-system/meta |
| encode data using XOR | data-manipulation/encoding/xor |
| PEB access | - |
| suspend thread | host-interaction/thread/suspend |
| create process suspended | host-interaction/process/create |
| change memory protection | - |
| allocate or change RWX memory | host-interaction/process/inject |
| contain loop | - |
| write file on Windows | host-interaction/file-system/write |
| check for time delay via GetTickCount | anti-analysis/anti-debugging/debugger-detection |
| terminate process | host-interaction/process/terminate |
| get OS version | - |
| check OS version | host-interaction/os/version |
| get geographical location | collection |
| identify system language via API | targeting/language |
| query or enumerate registry value | host-interaction/registry |
| get system information on Windows | host-interaction/os/info |
| set thread local storage value | host-interaction/thread/tls |
| get thread local storage value | host-interaction/process |
| get common file path | host-interaction/file-system |
| encrypt data using RC4 PRGA | data-manipulation/encryption/rc4 |
| get disk size | host-interaction/hardware/storage |
| get file version info | host-interaction/file-system/meta |
| query environment variable | host-interaction/environment-variable |
| accept command line arguments | host-interaction/cli |
| clear file content | host-interaction/file-system/write |
| hash data with CRC32 | data-manipulation/checksum/crc32 |
| delete file | host-interaction/file-system/delete |
| create directory | host-interaction/file-system/create |
| shutdown system | host-interaction/os |
| check if file exists | host-interaction/file-system/exists |
| extract resource via kernel32 functions | executable/resource |
| delete directory | host-interaction/file-system/delete |
| reference analysis tools strings | anti-analysis |
| compiled with Borland Delphi | compiler/delphi |
| packaged as an Inno Setup installer | executable/installer/inno-setup |
| contain a thread local storage (.tls) section | executable/pe/section/tls |
| reference anti-VM strings targeting Xen | anti-analysis/anti-vm/vm-detection |
ATT&CK techniques
Defense Evasion::Obfuscated Files or Information [T1027]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Discovery::File and Directory Discovery [T1083]Discovery::Query Registry [T1012]Discovery::System Information Discovery [T1082]Discovery::System Location Discovery [T1614]Discovery::System Location Discovery::System Language Discovery [T1614.001]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]Impact::System Shutdown/Reboot [T1529]Privilege Escalation::Access Token Manipulation [T1134]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockAnti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCountAnti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionCryptography::Encrypt Data::RC4Cryptography::Generate Pseudo-random SequenceCryptography::Generate Pseudo-random Sequence::RC4 PRGAData::Checksum::CRC32Data::Encode Data::XORData::ModuloDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete DirectoryFile System::Delete FileFile System::Get File AttributesFile System::Writes FileMemory::Allocate MemoryMemory::Change Memory ProtectionOperating System::Registry::Create Registry KeyOperating System::Registry::Open Registry KeyOperating System::Registry::Query Registry ValueProcess::Create ProcessProcess::Create Process::Create Suspended ProcessProcess::Create ThreadProcess::Set Thread Local Storage ValueProcess::Suspend ThreadProcess::Terminate Process
Signature matches
0 findings · 5 file properties · 0 scoredFile properties
IsPE32IsWindowsGUIIsPackedHasOverlayborland_delphi
These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.
No signature rule identified a threat in this file.
Extracted strings
showing 200 of 3468- This program must be run under Win32
- .text
- `.itext
- `.data
- .bss
- .idata
- .didata
- .edata
- @.tls
- .rdata
- @.rsrc
- Boolean
- False
- True
- System
- AnsiChar
- Char
- ShortInt
- SmallInt
- Integer
- Byte
- Word
- Cardinal
- Pointer
- UInt64
- NativeInt
- NativeUInt
- Single
- Extended
- Double
- Comp
- Currency
- ShortString
- PAnsiChar0
- PWideCharL
- ByteBool
- WordBool
- LongBool
- string
- WideString
- AnsiString
- Variant
- OleVariant
- TClass
- HRESULT
- TGUID
- &op_Equality
- Left
- Right
- &op_Inequality
- Create
- Data
- BigEndian
- AStartIndex
- PInterfaceEntry
- TInterfaceEntry
- VTable
- IOffset
- ImplGetter
- PInterfaceTable4
- TInterfaceTable
- EntryCount
- Entries
- TMethod
- Code
- &op_GreaterThan
- &op_GreaterThanOrEqual
- &op_LessThan
- &op_LessThanOrEqual
- TObject&
- Self
- Free
- DisposeOf
- InitInstance
- Instance
- CleanupInstance
- ClassType
- ClassName
- ClassNameIs
- Name
- ClassParent
- ClassInfo
- InstanceSize
- InheritsFrom
- AClass
- MethodAddress
- MethodName
- Address
- QualifiedClassName
- FieldAddress
- GetInterface
- GetInterfaceEntry
- GetInterfaceTable
- UnitName
- UnitScope
- GetHashCode
- ToString
- SafeCallException
- ExceptObject
- ExceptAddr
- AfterConstruction
- BeforeDestruction
- Dispatch
- Message
- DefaultHandler
- NewInstance
- FreeInstance
- Destroy
- TObjecth
- TCustomAttribute
- WeakAttribute
- UnsafeAttribute
- UnsafeAttribute@!@
- VolatileAttribute
- HPPGENAttribute5
- AData
- AFlag
- HPPGENAttribute
- PMonitorT$@
- TMonitor.PWaitingThread
- TMonitor.TWaitingThread
- Next
- Thread
- WaitEvent
- TMonitor.TSpinLock
- Enter
- Exit
- TMonitor
- FLockCount
- FRecursionCount
- FOwningThread
- FLockEvent
- FSpinCount
- SetSpinCount
- ASpinCount
- Timeout
- TryEnter
- Wait
- ALock
- Pulse
- PulseAll
- IInterface
- IEnumerable
- IDispatch
- FRefCount
- TInterfacedObject1
- TInterfacedObject
- RefCount
- PShortString
- UTF8String
- RawByteString
- PByte
- PInt64
- PExtended
- PCurrency
- PVariant
- PPointer
- TDateTime
- TDate
- TVarArrayBound
- ElementCount
- LowBound
- TVarArrayBoundArray
- PVarArray
- TVarArray
- DimCount
- Flags
- ElementSize
- LockCount
- Bounds
- TVarRecord
- PRecord
- RecInfo
- TVarData
- VType
- Reserved1
- Reserved2
- Reserved3
- VSmallInt
- VInteger
- VSingle
- VDouble
- VCurrency
- VDate
- VOleStr
- VDispatch
- VError
- VBoolean
- VShortInt
- VByte
- VWord
- VLongWord
- VUInt32
- VInt64
- VUInt64
- VString
- VAny
- VArray
- VPointer
- VUString
No strings match this filter.
Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.
Disassembly
entry point · x86 · 60 insns (listing capped)AddressBytesMnemonicOperands
0x4b5eec55pushebp
0x4b5eed8becmovebp, esp
0x4b5eef83c4a4addesp, -0x5c
0x4b5ef253pushebx
0x4b5ef356pushesi
0x4b5ef457pushedi
0x4b5ef533c0xoreax, eax
0x4b5ef78945c4movdword ptr [ebp - 0x3c], eax
0x4b5efa8945c0movdword ptr [ebp - 0x40], eax
0x4b5efd8945a4movdword ptr [ebp - 0x5c], eax
0x4b5f008945d0movdword ptr [ebp - 0x30], eax
0x4b5f038945c8movdword ptr [ebp - 0x38], eax
0x4b5f068945ccmovdword ptr [ebp - 0x34], eax
0x4b5f098945d4movdword ptr [ebp - 0x2c], eax
0x4b5f0c8945d8movdword ptr [ebp - 0x28], eax
0x4b5f0f8945ecmovdword ptr [ebp - 0x14], eax
0x4b5f12b8b8144b00moveax, 0x4b14b8
0x4b5f17e8b072f5ffcall0x40d1cc
0x4b5f1c33c0xoreax, eax
0x4b5f1e55pushebp
0x4b5f1f68e2654b00push0x4b65e2
0x4b5f2464ff30pushdword ptr fs:[eax]
0x4b5f27648920movdword ptr fs:[eax], esp
0x4b5f2a33d2xoredx, edx
0x4b5f2c55pushebp
0x4b5f2d689e654b00push0x4b659e
0x4b5f3264ff32pushdword ptr fs:[edx]
0x4b5f35648922movdword ptr fs:[edx], esp
0x4b5f38a134e64b00moveax, dword ptr [0x4be634]
0x4b5f3de8a29dffffcall0x4afce4
0x4b5f42e8f598ffffcall0x4af83c
0x4b5f478d55ecleaedx, [ebp - 0x14]
0x4b5f4a33c0xoreax, eax
0x4b5f4ce84fcdf6ffcall0x422ca0
0x4b5f518b55ecmovedx, dword ptr [ebp - 0x14]
0x4b5f54b8841d4c00moveax, 0x4c1d84
0x4b5f59e8a21ef5ffcall0x407e00
0x4b5f5e6a02push2
0x4b5f606a00push0
0x4b5f626a01push1
0x4b5f648b0d841d4c00movecx, dword ptr [0x4c1d84]
0x4b5f6ab201movdl, 1
0x4b5f6ca1ec384200moveax, dword ptr [0x4238ec]
0x4b5f71e8d2def6ffcall0x423e48
0x4b5f76a3881d4c00movdword ptr [0x4c1d88], eax
0x4b5f7b33d2xoredx, edx
0x4b5f7d55pushebp
0x4b5f7e684a654b00push0x4b654a
0x4b5f8364ff32pushdword ptr fs:[edx]
0x4b5f86648922movdword ptr fs:[edx], esp
0x4b5f89e82a9effffcall0x4afdb8
0x4b5f8ea3901d4c00movdword ptr [0x4c1d90], eax
0x4b5f93a1901d4c00moveax, dword ptr [0x4c1d90]
0x4b5f9883780c01cmpdword ptr [eax + 0xc], 1
0x4b5f9c7548jne0x4b5fe6
0x4b5f9ea1901d4c00moveax, dword ptr [0x4c1d90]
0x4b5fa3ba28000000movedx, 0x28
0x4b5fa8e8c7e7f6ffcall0x424774
0x4b5fad8b15901d4c00movedx, dword ptr [0x4c1d90]
0x4b5fb33b4228cmpeax, dword ptr [edx + 0x28]
callbranchretstackarithregisterimmediatememory
Nothing in this view
This sample produced no results for this part of the static analysis.
Installer package analysis
28 packaged files| Package | script-driven installer (setup data 6.1.0 (unicode)) |
|---|---|
| Name | INSIDE V2.0 6.1.0 |
| Contents listed | 28 entries |
| Password protected | no |
| Languages | englishrussianukrainian |
Packaged contents (28)
| Path | Size | Digest |
|---|---|---|
| app/INSIDE.exe | 404 KiB | 06e3da8cdfb1cbb4706… |
| app/flutter_windows.dll | 17.9 MiB | a9615c181bebab3abbc… |
| app/msvcp140.dll | 561 KiB | 8e6a0257591eb913ae7… |
| app/msvcp140_1.dll | 35 KiB | 5b252d10138d6666892… |
| app/screen_retriever_windows_plugin.dll | 112 KiB | 035bf65412192ea7f5e… |
| app/url_launcher_windows_plugin.dll | 86.5 KiB | 537fbecc236137acf55… |
| app/vcruntime140.dll | 117 KiB | 4812da5eb86a93fb0ad… |
| app/vcruntime140_1.dll | 48.5 KiB | dfa7a46012483837f47… |
| app/window_manager_plugin.dll | 136 KiB | aea3b95294e7fe9f5f5… |
| app/data/app.so | 5.5 MiB | 6940ec010fd10478727… |
| app/data/icudtl.dat | 760 KiB | 8a99bc860eda0772f3b… |
| app/data/flutter_assets/AssetManifest.bin | 924 B | fdf911565c6ccc9f481… |
| app/data/flutter_assets/AssetManifest.json | 853 B | 24e9a96cdae8ed51e80… |
| app/data/flutter_assets/FontManifest.json | 1.08 KiB | a4af7f96047912edbb7… |
| app/data/flutter_assets/NativeAssetsManifest.json | 45 B | adee29ec4f2b3cb2ec3… |
| app/data/flutter_assets/NOTICES.Z | 90.8 KiB | cf7f6a671c9eb12fbd8… |
| app/data/flutter_assets/fonts/MaterialIcons-Regular.otf | 1.57 MiB | fc25284ee3d0aaa75ec… |
| app/data/flutter_assets/lib/core/fonts/Consolas.ttf | 96.2 KiB | a32e7cdd5110945995e… |
| app/data/flutter_assets/lib/core/fonts/Koxu.otf | 29.2 KiB | 5f0352883f660f59509… |
| app/data/flutter_assets/lib/core/fonts/Pershotravneva55.ttf | 24.6 KiB | 66dc19d185a5cd9a255… |
| app/data/flutter_assets/lib/core/fonts/Pixel.ttf | 36.2 KiB | 2c0871c83e7a1cebb39… |
| app/data/flutter_assets/lib/core/fonts/Roboto.ttf | 466 KiB | bae5829821925c1c243… |
| app/data/flutter_assets/lib/core/fonts/SanFrancisco.ttf | 451 KiB | d38416ad361888e8cdb… |
| app/data/flutter_assets/packages/cupertino_icons/assets/CupertinoIcons.ttf | 251 KiB | 06f93e3f5ca41353c64… |
| app/data/flutter_assets/packages/font_awesome_flutter/lib/fonts/fa-brands-400.ttf | 204 KiB | eed786c07099f9169e3… |
Showing 25 of 28.
Import fingerprint
9 related samples| Fingerprint | 96:ukH+NbJj7t9X1tOz9Yhr8XbalVNb75krE:u0KX9FwBCI2rNb9kA |
|---|---|
| Imports read | 142 functions from 7 libraries (142 distinct) |
| Comparable | yes |
| Compared against | 90 stored samples |
Samples built on the same import table (9)
An identical import table survives repacking, so a high score usually means the same code rebuilt. It is corroboration, not a verdict of its own.
| Score | Sample | Verdict |
|---|---|---|
| 100 identical | 10b9c4411a341329bb4b453… | clean |
| 100 identical | 10b9c4411a341329bb4b453… | clean |
| 100 identical | 10b9c4411a341329bb4b453… | clean |
| 91 | 13e2ef2b923691986ebf894… | suspicious |
| 91 | 13e2ef2b923691986ebf894… | suspicious |
| 91 | 13e2ef2b923691986ebf894… | suspicious |
| 88 | f88b4200079dca27da65cd2… | suspicious |
| 72 | 33381a919316ab9a5ea3454… | suspicious |
| 72 | 33381a919316ab9a5ea3454… | suspicious |
1 further match belongs to scans outside your account and are not listed.
Screen recording
66 frames · screen recording · 166s1 / 66
Download this recording
Download video (.mp4)
Download GIF (.gif)
Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.
Behavior summary
ran 165s21 process(es) observed; malicious behavior: timestomping
LaunchedC:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe
Privilegeelevated
Defense Evasion::Timestomp [T1070.006]
timestomping
Telemetry sources:
Kernel ETW (0 events)
agent poll: 22Process audit: 21In-process monitor: 145Autostart diff: 42
Evasion / anti-analysis checks
9 checks
MED
System Checks Capability analysis
MITRE T1497
MED
Check for time delay via GetTickCount Capability rule
MITRE T1622 · Debugger detection
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Reference anti-VM strings targeting Xen Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Debugger Detection::Timing/Delay Check GetTickCount Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Virtual Machine Detection Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Anti-debug check dynamic
MITRE T1622 · anti_debug
Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).
Anti-analysis API trace
4 APIs · 7 processes hookedCalls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.
| API | Signal | Calls | Sleep | Scored |
|---|---|---|---|---|
| GetTickCount | timing | 1033 | - | no corroborates, never convicts on its own - ordinary software calls this |
| GetTickCount64 | timing | 1471 | - | no corroborates, never convicts on its own - ordinary software calls this |
| IsDebuggerPresent | anti_debug | 522 | - | yes |
| Sleep | sleep | 27 | 13389 ms total · 500 ms max | no under the floor a stall has to cross (30s in total or 10s at once) |
Call order 32 events sampled
IsDebuggerPresentGetTickCountIsDebuggerPresentGetTickCount64GetTickCountGetTickCount64GetTickCountGetTickCount64GetTickCount64GetTickCountIsDebuggerPresentSleepSleepGetTickCountIsDebuggerPresentGetTickCount64GetTickCountGetTickCountGetTickCount64IsDebuggerPresentIsDebuggerPresentGetTickCountGetTickCount64SleepSleepIsDebuggerPresentGetTickCountGetTickCount64GetTickCountGetTickCountGetTickCount64GetTickCount
How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.
Module loads
3 notable · 26 from system directoriesModules the sample asked for by name while it ran, recorded inside its own process. Loads from system and installed-program directories are counted but not listed - what is listed is a module from somewhere else, a load that failed, or one whose loader is the question.
| Process | Module | Loaded | Why listed |
|---|---|---|---|
| INSIDE.exe 3612 | C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf… asked for comctl32.dll | yes | resolved by search order, not by a full path |
| INSIDE_V2.0.0_Windows_Installer.tmp 5964 | C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1d… asked for comctl32.dll | yes | resolved by search order, not by a full path |
| INSIDE_V2.0.0_Windows_Installer.tmp 5964 | C:\Windows\SYSTEM32\SspiCli.dll asked for sspicli.dll | yes | a module whose loader is the question |
What this list cannot say: only an explicit LoadLibrary call is recorded, so a module the sample brought in through its own import table never appears here - absence from this list is not absence from the process. There is no signature check behind these rows, so an unlisted module is not a module that was verified. The hooks are placed a few seconds after a process starts, so the first loads of a launch are missed.
No WMI attributed to the sample. The WMI-Activity trace was running and recorded 527 operations on the machine during the run; none of them came from the sample's process tree.
File timestamp writes
15 filesCaptured in the calling process, so the values are the ones the sample asked for rather than what the file ended up with. Setting file times is ordinary - installers and archivers do it - so only a write that moves a file's history backwards is marked as timestomping.
C:\Program Files (x86)\INSIDE V2.0\is-A853E.tmp pid 5964
created=unchanged modified=2026-10-22T11:50:39Z accessed=unchanged
was created=2026-10-22T11:50:45Z modified=2026-10-22T11:50:45Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-J9APA.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:34Z accessed=unchanged
was created=2026-10-22T11:50:45Z modified=2026-10-22T11:50:45Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-V1OFU.tmp pid 5964
created=unchanged modified=2025-02-13T12:16:48Z accessed=unchanged
was created=2026-10-22T11:50:45Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-19RFB.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:34Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-2EAJK.tmp pid 5964
created=unchanged modified=2025-05-09T13:06:38Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-GVVD8.tmp pid 5964
created=unchanged modified=2025-05-09T13:06:40Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-NCT2M.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:24Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-AI5O4.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:28Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-CLUMK.tmp pid 5964
created=unchanged modified=2025-05-09T13:06:42Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-NJ7FB.tmp pid 5964
created=unchanged modified=2025-05-09T13:06:44Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\is-01NC5.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:32Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:47Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\data\is-T032F.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:14Z accessed=unchanged
was created=2026-10-22T11:50:47Z modified=2026-10-22T11:50:48Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\data\is-HJIH7.tmp pid 5964
created=unchanged modified=2025-02-13T12:16:10Z accessed=unchanged
was created=2026-10-22T11:50:48Z modified=2026-10-22T11:50:48Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\is-K6GNA.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:14Z accessed=unchanged
was created=2026-10-22T11:50:48Z modified=2026-10-22T11:50:48Z
BACKDATED
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\is-S1432.tmp pid 5964
created=unchanged modified=2025-08-05T19:37:14Z accessed=unchanged
was created=2026-10-22T11:50:48Z modified=2026-10-22T11:50:48Z
Command lines, unwrapped
19 read19 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.
Network activity
The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.
This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
21processes
121file operations
59registry operations
INSIDE_V2.0.0_Windows_Installer.exe
21 processes
21 processes
Attributed activity
INSIDE_V2.0.0_Windows_Installer.exe
PID 2308
Image
C:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe
Command
"C:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe"
Parent
not captured - its parent is outside the sample's tree
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
INSIDE_V2.0.0_Windows_Installer.tmp
PID 1196
Image
C:\Users\user\AppData\Local\Temp\is-7O0K1.tmp\INSIDE_V2.0.0_Windows_Installer.tmp
Command
"C:\Users\user\AppData\Local\Temp\is-7O0K1.tmp\INSIDE_V2.0.0_Windows_Installer.tmp" /SL5="$401E6,10459832,1143296,C:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe"
Parent
PID 2308 · INSIDE_V2.0.0_Windows_Installer.exe
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp
Children
15
File operations49
createC:\Users\user\AppData\Local\Programs
createC:\Users\user\AppData\Local\Programs\Common
createC:\Users\user\AppData\Local\Temp\is-2QI77.tmp\_isetup
createC:\Program Files (x86)\INSIDE V2.0
createC:\Program Files (x86)\INSIDE V2.0\unins000.dat
renameC:\Program Files (x86)\INSIDE V2.0\unins000.exe
renameC:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
renameC:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
deleteC:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
renameC:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
renameC:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
renameC:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
renameC:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
renameC:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
renameC:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
renameC:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
createC:\Program Files (x86)\INSIDE V2.0\data
renameC:\Program Files (x86)\INSIDE V2.0\data\app.so
renameC:\Program Files (x86)\INSIDE V2.0\data\icudtl.dat
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.bin
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.json
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\FontManifest.json
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NativeAssetsManifest.json
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NOTICES.Z
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts\MaterialIcons-Regular.otf
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Consolas.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Koxu.otf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pershotravneva55.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pixel.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Roboto.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\SanFrancisco.ttf
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons
createC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf
Showing the first 40 of 49. The full list is on the File & registry section.
Registry operations42
createSoftware\Microsoft\RestartManager\Session0000
create\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
create\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D67EB007-EC98-4B70-BAD6-05CFE0D511A2}_is1
createSoftware\Classes\Applications\INSIDE.exe\SupportedTypes
createSoftware\Classes\INSIDEV2.0.myp\shell\open\command
createSoftware\Classes\INSIDEV2.0.myp\DefaultIcon
createSoftware\Classes\INSIDEV2.0.myp
create\REGISTRY\MACHINE\SOFTWARE\Classes
create\REGISTRY\MACHINE\Software\WOW6432Node
createSoftware\Classes\.myp\OpenWithProgids
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Edge\
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Edge\ElfBeacon\
createSoftware\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
createSoftware\Microsoft\Edge\StabilityMetrics
createSOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
createSoftware\Microsoft\Edge\SmartScreenEnabled
createSoftware\Microsoft\Edge\SmartScreenPuaEnabled
createSoftware\Microsoft\Edge
createSoftware\Microsoft\Windows\CurrentVersion\Internet Settings
createSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
create\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
createSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
create\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
create\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}
createSOFTWARE\Microsoft\Edge\IEToEdge
createSoftware\Microsoft\Edge\Defaults
createSoftware\Microsoft\Edge\BLBeacon
create\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Edge\Extensions
createSoftware\Microsoft\Edge\Extensions
createSOFTWARE\Microsoft\Windows\CurrentVersion\Feeds
createSoftware\Microsoft\Windows\CurrentVersion\Policies\DataCollection
createSoftware\Policies\Microsoft\Windows\DataCollection
createSoftware\Microsoft\Edge\PreferenceMACs\Default
createSoftware\Microsoft\Edge\PreferenceMACs\Default\extensions.settings
createSoftware\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
createSoftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3020052414-521178761-3546482252-1000\{9BCCD81D-C758-4702-8B72-D68A3CB7EB4D}
createSoftware\Microsoft\Edge\Profiles\Default
Showing the first 40 of 42. The full list is on the File & registry section.
INSIDE.exe
PID 3612
Image
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
Command
"C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe"
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> inside.exe
File operations2
createC:\Users\user\Documents\inside_v2.0.hive
createC:\Users\user\Documents\inside_v2.0.lock
Registry operations10
createSoftware\Microsoft\WBEM\CIMOM
createSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
createSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders
createSoftware\Microsoft\Windows\CurrentVersion\Explorer
createSoftware\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
setvalueSOFTWARE\Microsoft\Windows\CurrentVersion\ExplorerSlowContextMenuEntries = <100 bytes, type 3>
setvalueSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ContentCachePrefix =
setvalueSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\CookiesCachePrefix = Cookie:
setvalueSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\HistoryCachePrefix = Visited:
create\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
msedge.exe
PID 808
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=150.0.7871.115 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=150.0.4078.65 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x2b4,0x7ffbbc7ddcf0,0x7ffbbc7ddcfc,0x7ffbbc7ddd08
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
File operations1
create\\.\pipe\crashpad_1196_GHOSUQPQOEUIVAQH
msedge.exe
PID 624
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1928,i,5724877371066843080,3636302553820356933,524288 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2700 /prefetch:3
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 2460
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --startup-read-main-dll --metrics-shmem-handle=1676,i,1721314409408225745,17552531153425697907,262144 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2092 /prefetch:2
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 2200
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2476,i,17785193945576127359,7617935367706652670,524288 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2804 /prefetch:8
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 3096
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --ram-no-pressure-read-main-dll --metrics-shmem-handle=3356,i,502495892629118048,17915518025827202496,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3360 /prefetch:1
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 2204
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --skip-read-main-dll --metrics-shmem-handle=3376,i,9091225385352516366,8383361927515376037,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3388 /prefetch:1
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 5128
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3860,i,7035040139359263742,8923492511295044047,524288 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3900 /prefetch:8
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 5428
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --skip-read-main-dll --metrics-shmem-handle=5180,i,3359342118078766246,9818176499075907065,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5208 /prefetch:2
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 5628
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --skip-read-main-dll --metrics-shmem-handle=5144,i,12030336843259933849,320067124917111435,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3368 /prefetch:1
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 5696
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --skip-read-main-dll --metrics-shmem-handle=3400,i,8527763600539778684,13714621369373791823,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3388 /prefetch:1
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 5712
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5492,i,4946747392655498332,15987970317253542635,524288 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3520 /prefetch:8
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedge.exe
PID 6020
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --skip-read-main-dll --metrics-shmem-handle=6104,i,10485136614500201206,7441876606408623512,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6292 /prefetch:1
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
setup.exe
PID 4132
Image
C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.65\Installer\setup.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.65\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable --force-configure-user-settings
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> setup.exe
Children
1
Registry operations4
createSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList
createSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList
createSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList
createSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\OpenWithList
setup.exe
PID 5308
Image
C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.65\Installer\setup.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.65\Installer\setup.exe" --msedge --channel=stable --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
Parent
PID 4132 · setup.exe
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> setup.exe
File operations1
createC:\Users\user\Desktop\Microsoft Edge.lnk
msedge.exe
PID 5052
Image
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Command
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --ram-no-pressure-read-main-dll --metrics-shmem-handle=4740,i,3263123101241443569,6466760815256723129,2097152 --field-trial-handle=2032,i,1871471671473903031,11946364033024886695,262144 --variations-seed-version --pseudonymization-salt-handle=2100,i,17594329168238557563,5392633895923302514,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4560 /prefetch:1
Parent
PID 1196 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> msedge.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
INSIDE_V2.0.0_Windows_Installer.exe
PID 6120
Image
C:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe
Command
"C:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe"
Parent
not captured - its parent is outside the sample's tree
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
INSIDE_V2.0.0_Windows_Installer.tmp
PID 5964
Image
C:\Users\user\AppData\Local\Temp\is-TLDAU.tmp\INSIDE_V2.0.0_Windows_Installer.tmp
Command
"C:\Users\user\AppData\Local\Temp\is-TLDAU.tmp\INSIDE_V2.0.0_Windows_Installer.tmp" /SL5="$202A0,10459832,1143296,C:\Users\user\Desktop\INSIDE_V2.0.0_Windows_Installer.exe"
Parent
PID 6120 · INSIDE_V2.0.0_Windows_Installer.exe
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp
Children
1
File operations67
renameC:\Program Files (x86)\INSIDE V2.0\unins000.exe
renameC:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
renameC:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
deleteC:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
renameC:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
renameC:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
renameC:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
renameC:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
renameC:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
renameC:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
renameC:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
renameC:\Program Files (x86)\INSIDE V2.0\data\app.so
renameC:\Program Files (x86)\INSIDE V2.0\data\icudtl.dat
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.bin
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.json
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\FontManifest.json
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NativeAssetsManifest.json
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NOTICES.Z
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts\MaterialIcons-Regular.otf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Consolas.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Koxu.otf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pershotravneva55.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pixel.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Roboto.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\SanFrancisco.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\shaders\ink_sparkle.frag
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-solid-900.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-regular-400.ttf
renameC:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-brands-400.ttf
createC:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
createC:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
createC:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
createC:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
createC:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
createC:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
createC:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
createC:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
createC:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
deleteC:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
Showing the first 40 of 67. The full list is on the File & registry section.
Registry operations3
setvalueSOFTWARE\Microsoft\RestartManager\Session0000RegFiles0000 = <1102 bytes, type 7>
setvalueSOFTWARE\Microsoft\RestartManager\Session0000RegFilesHash = <32 bytes, type 3>
createSoftware\Microsoft\RFC1156Agent\CurrentVersion\Parameters
INSIDE.exe
PID 4152
Image
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
Command
"C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe"
Parent
PID 5964 · INSIDE_V2.0.0_Windows_Installer.tmp
Chain
inside_v2.0.0_windows_installer.exe -> inside_v2.0.0_windows_installer.tmp -> inside.exe
File operations1
createC:\Users\user\Documents\inside_v2.0.lock
Not attributed to any process
2 kindsThese operations were captured but carry no pid this tree could match, so they are not shown against any node above.
File operations4
Registry operations42
1Mechanisms found
90Methods checked
1ATT&CK techniques
HIGHHighest severity
Persistence mechanisms
1 found| Method | Family | ATT&CK | Evidence | Severity |
|---|---|---|---|---|
| Shell Open Command Hijack | Execution Hijack | T1546.001 | Runtime | HIGH |
Runtime evidence means the mechanism was established during detonation. A static hint means the sample only references the technique.
Detection coverage
1 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".
Logon & Startup
22 clean
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
Services & Tasks
9 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
Execution Hijack
1 / 17
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 detected
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
DLL Load Order
12 clean
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 clean
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
COM & Browser
6 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
Security Providers & Accounts
11 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
Scripting & Applications
9 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
Boot & Firmware
4 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
create 33
write 0
modify 3
delete 44
rename 58
Dropped payload analysis
9 payloads examined of 10Each payload the sample wrote and this run kept was scanned by the antivirus engine and identified locally. 9 of them were examined and none was flagged. That is a result about these bytes only: a payload the caps turned away, or one the capture never kept, is reported separately.
1 further payload was kept but not examined: larger than the 16 MB per-payload budget. It is listed above with its hash. Unexamined, not clean.
Whether any of these payloads is already known to an outside source was not established for this scan: reputation enrichment is a paid-plan layer. The antivirus result and the identification below ran locally and are complete.
| Payload | Where it landed | What it is | Antivirus | Download |
|---|---|---|---|---|
| unins000.exe | C:\Program Files (x86)\INSIDE V2.0\unins000.exe | Windows executableInno Setuppacked2 signature matches |
no detection | ZIP |
| INSIDE.exe | C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe | Windows executable |
no detection | ZIP |
| msvcp140.dll | C:\Program Files (x86)\INSIDE V2.0\msvcp140.dll | Windows executablesigned |
no detection | ZIP |
| msvcp140_1.dll | C:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll | Windows executablesigned |
no detection | ZIP |
| screen_retriever_windows_plugin.dll | C:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll | Windows executable |
no detection | ZIP |
| url_launcher_windows_plugin.dll | C:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll | Windows executable |
no detection | ZIP |
| vcruntime140.dll | C:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll | Windows executablesigned1 signature match |
no detection | ZIP |
| vcruntime140_1.dll | C:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll | Windows executablesigned1 signature match |
no detection | ZIP |
| window_manager_plugin.dll | C:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll | Windows executable |
no detection | ZIP |
File & registry ops
138 file · 59 registry · sample scope
File operation times: 7 timed2 operation time129 not observed
| Operation | Target | Process | |
|---|---|---|---|
| create |
C:\Users\user\AppData\Local\Programs
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Users\user\AppData\Local\Programs\Common
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\is-2QI77.tmp\_isetup
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | 2026-10-22 14:49:11.418 |
| create |
C:\Program Files (x86)\INSIDE V2.0
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\unins000.dat
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\unins000.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\unins000.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\app.so
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\app.so
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\icudtl.dat
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\icudtl.dat
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.bin
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.bin
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\FontManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\FontManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NativeAssetsManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NativeAssetsManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NOTICES.Z
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NOTICES.Z
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts\MaterialIcons-Regular.otf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts\MaterialIcons-Regular.otf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Consolas.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Consolas.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Koxu.otf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Koxu.otf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pershotravneva55.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pershotravneva55.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pixel.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pixel.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Roboto.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Roboto.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\SanFrancisco.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\SanFrancisco.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\shaders\ink_sparkle.frag
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\shaders\ink_sparkle.frag
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\shaders
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-solid-900.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-solid-900.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-regular-400.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-regular-400.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-brands-400.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not observed |
| rename |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-brands-400.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Users\user\AppData\Local\Temp\is-2QI77.tmp\_isetup
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | 2026-10-22 14:49:26.137 |
| create |
C:\Users\user\Documents\inside_v2.0.hive
|
INSIDE.exe pid 3612 | 2026-10-22 14:49:26.138 |
| create |
C:\Users\user\Documents\inside_v2.0.lock
|
INSIDE.exe pid 3612 | 2026-10-22 14:49:26.139operation time |
| create |
C:\Users\user\Documents\inside_v2.0.lock
|
INSIDE.exe pid 4152 | 2026-10-22 14:49:26.139operation time |
| create |
C:\Users\user\Documents\inside_v2.0.lock
|
- | 2026-10-22 14:49:26.139 |
| modify |
C:\Users\user\AppData\Local\Temp\is-2QI77.tmp\_isetup
|
- | 2026-10-22 14:49:26.137 |
| create |
C:\Users\user\Desktop\Microsoft Edge.lnk
|
setup.exe pid 5308 | not observed |
| create |
\\.\pipe\crashpad_1196_GHOSUQPQOEUIVAQH
|
msedge.exe pid 808 | not observed |
| modify |
C:\Users\user\Documents\inside_v2.0.hive
|
- | 2026-10-22 14:50:37.212 |
| create |
C:\Program Files (x86)\INSIDE V2.0\INSIDE.exe
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| create |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\flutter_windows.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\msvcp140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\msvcp140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\screen_retriever_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\url_launcher_windows_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\vcruntime140_1.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\window_manager_plugin.dll
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\app.so
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\app.so
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\icudtl.dat
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\icudtl.dat
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.bin
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.bin
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\AssetManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\FontManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NativeAssetsManifest.json
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\NOTICES.Z
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\fonts\MaterialIcons-Regular.otf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Consolas.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Koxu.otf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pershotravneva55.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Pixel.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\Roboto.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\lib\core\fonts\SanFrancisco.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-brands-400.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-regular-400.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\packages\font_awesome_flutter\lib\fonts\fa-solid-900.ttf
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Program Files (x86)\INSIDE V2.0\data\flutter_assets\shaders\ink_sparkle.frag
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| delete |
C:\Users\user\AppData\Local\Temp\is-MTOQA.tmp\_isetup
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not observed |
| modify |
C:\Users\user\Documents\inside_v2.0.lock
|
- | 2026-10-22 14:50:53.296 |
| create |
Software\Microsoft\RestartManager\Session0000
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D67EB007-EC98-4B70-BAD6-05CFE0D511A2}_is1
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Classes\Applications\INSIDE.exe\SupportedTypes
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Classes\INSIDEV2.0.myp\shell\open\command
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Classes\INSIDEV2.0.myp\DefaultIcon
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Classes\INSIDEV2.0.myp
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\SOFTWARE\Classes
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Classes\.myp\OpenWithProgids
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\WBEM\CIMOM
|
INSIDE.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
|
INSIDE.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders
|
INSIDE.exe pid 3612 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Explorer
|
INSIDE.exe pid 3612 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
|
INSIDE.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries = <100 bytes, type 3>
|
INSIDE.exe pid 3612 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Edge\
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Edge\ElfBeacon\
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| setvalue |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
CachePrefix =
|
INSIDE.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
CachePrefix = Cookie:
|
INSIDE.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
CachePrefix = Visited:
|
INSIDE.exe pid 3612 | not timed |
| create |
Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\StabilityMetrics
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\SmartScreenEnabled
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\SmartScreenPuaEnabled
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Internet Settings
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
SOFTWARE\Microsoft\Edge\IEToEdge
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\Defaults
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\BLBeacon
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Edge\Extensions
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\Extensions
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Policies\Microsoft\Windows\DataCollection
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
|
INSIDE.exe pid 3612 | not timed |
| create |
Software\Microsoft\Edge\PreferenceMACs\Default
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3020052414-521178761-3546482252-1000\{9BCCD81D-C758-4702-8B72-D68A3CB7EB4D}
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\Profiles\Default
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Edge\Profiles\
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 1196 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList
|
setup.exe pid 4132 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList
|
setup.exe pid 4132 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList
|
setup.exe pid 4132 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\OpenWithList
|
setup.exe pid 4132 | not timed |
| setvalue |
SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000 = <1102 bytes, type 7>
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not timed |
| setvalue |
SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash = <32 bytes, type 3>
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not timed |
| setvalue |
System\CurrentControlSet\Services\PptpMiniport
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasPppoe
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarp
Start = 2
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\ndproxy
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarpv6
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasAgileVpn
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarpv6
DriverMajorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\NdisWan
DriverMinorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\PptpMiniport
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasPppoe
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\Rasl2tp
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarpv6
NdisMinorVersion = 84
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\ndproxy
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\NdisWan
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarp
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasSstp
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\ndiswanlegacy
NdisMajorVersion = 5
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\ndiswanlegacy
NdisMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarp
DriverMajorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\NdisWan
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasAgileVpn
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\PptpMiniport
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\NdisWan
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarpv6
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarp
NdisMinorVersion = 84
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasPppoe
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasAgileVpn
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\Rasl2tp
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasSstp
NdisMajorVersion = 6
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasAgileVpn
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\Rasl2tp
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasMan\Parameters
MiniportsInstalled = 65535
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasMan
Start = 2
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\Rasl2tp
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasSstp
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasPppoe
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\wanarp
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasMan
DelayedAutostart = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\PptpMiniport
DriverMinorVersion = 0
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\RasSstp
NdisMinorVersion = 30
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\ndproxy
DriverMajorVersion = 1
|
- | not timed |
| setvalue |
System\CurrentControlSet\Services\ndproxy
NdisMajorVersion = 6
|
- | not timed |
| create |
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
|
INSIDE_V2.0.0_Windows_Installer.tmp pid 5964 | not timed |
No operations match your filter.
External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.
0Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer
File reputation
4 clear · 3 not checked| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| MalwareBazaar hash feed | File hash | clean | not in feed | 3,003 records 48 minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 3,348 records 4 hours ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,153 records 48 minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,680 records 48 minutes ago |
| filescan.io | File hash | not checked | no hash lookup ran for this scan | live lookup |
| MalwareBazaar | File hash | not checked | no hash lookup ran for this scan | live lookup |
| VirusTotal | File hash | not checked | no hash lookup ran for this scan | live lookup |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
7 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| URLhaus | IP / domain / URL | feed unavailable | 4 observed indicators, none listed | no records ingested |
| blocklist.de | IP / domain / URL | clean | 4 observed indicators, none listed | 27.6k records 48 minutes ago |
| CINS Army | IP / domain / URL | clean | 4 observed indicators, none listed | 15k records 48 minutes ago |
| Emerging Threats | IP / domain / URL | clean | 4 observed indicators, none listed | 482 records 48 minutes ago |
| Feodo Tracker | IP / domain / URL | clean | 4 observed indicators, none listed | 5 records 48 minutes ago |
| IPsum | IP / domain / URL | clean | 4 observed indicators, none listed | 19.7k records 48 minutes ago |
| Phishing.Database | IP / domain / URL | clean | 4 observed indicators, none listed | 391.5k records 4 hours ago |
| ThreatFox | IP / domain / URL | clean | 4 observed indicators, none listed | 1,153 records 48 minutes ago |
TLS fingerprints
nothing of this kind to check| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| JA3 / JA4 fingerprint blocklists | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 10 hours ago |
| SSL blocklist | Server certificate | not checked | no server certificate fingerprint is extracted to check | live lookup |
Detection rules
2 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Sigma rules | Behavior log | clean | - | 2,275 records 5 hours ago |
| Signature rules | Sample content | clean | 5 structural rules matched (file properties, not findings) | 110 records 49 minutes ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 21 process image paths, none masqueraded | 245 records 49 minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 48 minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,333 records 48 minutes ago |
| LOLRMM | Names and domains | clean | 25 name/domain indicators checked, no remote-management tooling | 360 records 48 minutes ago |
AI analysis
The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.
Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.
3 malicious
1 suspicious
0 info
File indicators
3| Severity | Type | Indicator | Description |
|---|---|---|---|
| malicious | sample_sha256 | 69982e7cb0e56bf5fb10eb111a93ef1cded0440e08beaab312e6d42e6f235b4a | Submitted sample (SHA256) |
| malicious | sample_md5 | b5dc4083e64ed6e73046d5b99ac9ebbb | Submitted sample (MD5) |
| malicious | imphash | e569e6f445d32ba23766ad67d1e3787f | Import table hash (imphash) |
Registry indicators
1| Severity | Type | Indicator | Description |
|---|---|---|---|
| suspicious | registry_key | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters | Autostart / persistence key |
MITRE ATT&CK
1 techniqueDefense Evasion
Timestomp
T1070.006Sigma detections
0 matches of 2275 rulesThe Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.
Generated rules
Sigma: auto_file_2895_sigma_reg
Auto-generatedtitle: Auto-generated registry behavior rule (sandbox scan 2895)
id: sandbox-auto-2895-reg
status: experimental
description: Auto-generated from sandbox scan 2895
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains:
- 'Software\Microsoft\RestartManager\Session0000'
- '\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer'
- '\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D67EB007-EC98-4B70-BAD6-05CFE0D511A2}_is1'
- 'Software\Classes\Applications\INSIDE.exe\SupportedTypes'
- 'Software\Classes\INSIDEV2.0.myp\shell\open\command'
- 'Software\Classes\INSIDEV2.0.myp\DefaultIcon'
- 'Software\Classes\INSIDEV2.0.myp'
- '\REGISTRY\MACHINE\SOFTWARE\Classes'
condition: selection
level: mediumYARA: auto_file_2895_yara
Auto-generatedimport "pe"
rule auto_file_2895_yara
{
meta:
description = "Auto-generated from scan 2895"
author = "sandbox auto-generator"
imphash = "e569e6f445d32ba23766ad67d1e3787f"
condition:
uint16(0) == 0x5a4d and filesize < 45862884 and pe.imphash() == "e569e6f445d32ba23766ad67d1e3787f"
}Extracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
Artifacts
10 files| Type | Name | Size | What it is | SHA-256 | Download | |
|---|---|---|---|---|---|---|
| Dropped file | unins000.exe | 3.3 MB | - | 9827b315256ab7b41ec9b7bbf1d7341a4f0a63334eb26e4ed848d2df53ad2850 | ZIP | |
| Dropped file | INSIDE.exe | 404.5 KB | - | 4d917d336ff537a97a987cfe55d15efadf4b9423e9b6ee5028a2c31e0593f2ef | ZIP | |
| Dropped file | flutter_windows.dll | 17.9 MB | - | da733f3625eec50d3e5e021adca35fb37d6399ea4d9586213858f9eee74b5f6b | ZIP | |
| Dropped file | msvcp140.dll | 561.6 KB | - | a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde | ZIP | |
| Dropped file | msvcp140_1.dll | 35.0 KB | - | 91cd05c16c61c39788c47434602a59c17f5b08dbb3eee04ce85f8d5b70e8e604 | ZIP | |
| Dropped file | screen_retriever_windows_plugin.dll | 112.5 KB | - | bef0a8a22eaf7f7c5a31e6df6fa5eb56a316350d151c00c6e063acefe2cc93a8 | ZIP | |
| Dropped file | url_launcher_windows_plugin.dll | 86.5 KB | - | 255f4190325b9f54b59ce8057a882562ad29f02d9aa605a126354831452eadf2 | ZIP | |
| Dropped file | vcruntime140.dll | 117.1 KB | - | 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a | ZIP | |
| Dropped file | vcruntime140_1.dll | 48.5 KB | - | 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637 | ZIP | |
| Dropped file | window_manager_plugin.dll | 136.5 KB | - | e42a9227209a4e3198830ac7c7a7601d27f0ddf25f30d780abcc1f736f503b91 | ZIP |
Export & download
/s/2895Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Generating AI report
Building your report...Compiling the AI narrative and derived evidence. This can take a moment.
Report readyYour report has been generated.
Download
Could not generate the reportPlease try again.
Not available for this scanIt was submitted under ultra privacy, so no derived data from it is sent to the model - and this document is written from that data. Every other section of this report is unaffected.
Headers
Body
Headers
Body
Download live malware sample
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
1 run| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-10-22 14:48 Shown below | Windows 10 22H2 | Malicious | 78/100 |