File name:

#Pa$CŌݔe--2244__OpeN-Set-UPD-PC34@!#$Patch2244.tar

Full analysis: https://app.any.run/tasks/9cb53746-a012-4126-84b4-7391c6fcc61f
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 13, 2025, 20:32:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
delphi
Indicators:
MIME: application/x-tar
File info: POSIX tar archive (GNU)
MD5:

881C8E0889E2039446869498B4FBEADE

SHA1:

2491D30156C1E303E50D57BEDDE3A3624173BB08

SHA256:

0A02EDC01CF1B95FD647D8A12C7FA0C964DBB357B27CC1789A4D0ECCC278837B

SSDEEP:

98304:78ggU8AEVqIkiRztfN9Mtw8mXXvWcUFjLMT8Vg+wnyY+PEfYhNNjkz80G1NmtsMk:92rAQHVaOgGY/CpdYRRKe5vujb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Set-up.exe (PID: 8092)
      • hjksfl.exe (PID: 2088)
      • hjksfl.exe (PID: 7692)
      • shark.exe (PID: 5988)
      • hjksfd.exe (PID: 3304)

    • Actions looks like stealing of personal data

      • Set-up.exe (PID: 8092)

    • Steals credentials from Web Browsers

      • Set-up.exe (PID: 8092)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7716)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7964)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • Set-up.exe (PID: 8092)
      • MicrosoftEdgeUpdate.exe (PID: 4180)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7560)
      • Set-up.exe (PID: 8092)
      • wipe.com (PID: 6592)

    • Application launched itself

      • WinRAR.exe (PID: 7560)

    • Executes application which crashes

      • hjksfl.exe (PID: 2088)
      • hjksfd.exe (PID: 3304)
      • shark.exe (PID: 5988)

    • Executable content was dropped or overwritten

      • Set-up.exe (PID: 8092)
      • hjksfl.exe (PID: 7692)
      • hjksfd.exe (PID: 3304)
      • wipe.com (PID: 6592)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7628)

    • There is functionality for taking screenshot (YARA)

      • hjksfd.exe (PID: 3304)
      • wipe.com (PID: 6592)
      • shark.exe (PID: 5988)

    • Starts application with an unusual extension

      • hjksfl.exe (PID: 7692)

    • Connects to unusual port

      • wipe.com (PID: 6592)
      • shark.exe (PID: 5988)

    • Starts CMD.EXE for commands execution

      • hjksfd.exe (PID: 3304)

    • Starts POWERSHELL.EXE for commands execution

      • wipe.com (PID: 6592)

    • Starts process via Powershell

      • powershell.exe (PID: 7672)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 7628)
      • MicrosoftEdgeUpdate.exe (PID: 4180)
      • wipe.com (PID: 6592)

    • The process executes via Task Scheduler

      • shark.exe (PID: 5988)

    • Uses WMIC.EXE to obtain Windows Installer data

      • shark.exe (PID: 5988)

    • Potential Corporate Privacy Violation

      • Set-up.exe (PID: 8092)

    • Process requests binary or script from the Internet

      • Set-up.exe (PID: 8092)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 7560)
      • Set-up.exe (PID: 8092)

    • Checks supported languages

      • Set-up.exe (PID: 8092)
      • elevation_service.exe (PID: 7260)
      • hjksfl.exe (PID: 2088)
      • hjksfl.exe (PID: 7692)
      • wipe.com (PID: 6592)
      • hjksfd.exe (PID: 3304)

    • Reads the machine GUID from the registry

      • Set-up.exe (PID: 8092)
      • hjksfl.exe (PID: 2088)
      • wipe.com (PID: 6592)

    • Reads the computer name

      • Set-up.exe (PID: 8092)
      • elevation_service.exe (PID: 7260)
      • hjksfl.exe (PID: 2088)
      • hjksfl.exe (PID: 7692)
      • wipe.com (PID: 6592)

    • Executes as Windows Service

      • elevation_service.exe (PID: 7260)

    • Create files in a temporary directory

      • hjksfl.exe (PID: 2088)
      • hjksfl.exe (PID: 7692)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5728)
      • WerFault.exe (PID: 7280)
      • WerFault.exe (PID: 5800)
      • wipe.com (PID: 6592)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7716)

    • Process checks computer location settings

      • Set-up.exe (PID: 8092)

    • Creates files in the program directory

      • hjksfd.exe (PID: 3304)
      • hjksfl.exe (PID: 7692)
      • wipe.com (PID: 6592)

    • The sample compiled with english language support

      • hjksfl.exe (PID: 7692)
      • wipe.com (PID: 6592)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7628)
      • MicrosoftEdgeUpdate.exe (PID: 4180)
      • Set-up.exe (PID: 8092)

    • Compiled with Borland Delphi (YARA)

      • hjksfd.exe (PID: 3304)
      • shark.exe (PID: 5988)

    • Reads the software policy settings

      • slui.exe (PID: 7496)
      • wipe.com (PID: 6592)

    • Checks proxy server information

      • wipe.com (PID: 6592)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • hjksfd.exe (PID: 3304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.tar | TAR - Tape ARchive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
211
Monitored processes
56
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe no specs winrar.exe no specs set-up.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs hjksfd.exe hjksfl.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs CMSTPLUA hjksfl.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs wipe.com werfault.exe no specs werfault.exe no specs tcpvcon.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe conhost.exe no specs microsoftedgeupdate.exe wermgr.exe shark.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs wmic.exe no specs conhost.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—Set-up.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736C:\WINDOWS\SysWOW64\WerFault.exe -u -p 3304 -s 164C:\Windows\SysWOW64\WerFault.exe—hjksfd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
812C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5988 -s 616C:\Windows\SysWOW64\WerFault.exe—shark.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1116C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5988 -s 596C:\Windows\SysWOW64\WerFault.exe—shark.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Users\admin\hjksfl.exe" C:\Users\admin\hjksfl.exe
Set-up.exe
User:
admin
Company:
Qihoo 360 Technology Co. Ltd.
Integrity Level:
MEDIUM
Description:
File Smasher Application
Exit code:
0
Version:
14, 0, 0, 1031
Modules
Images
c:\users\admin\hjksfl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2152wmic csproduct get UUIDC:\Windows\SysWOW64\wbem\WMIC.exe—shark.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
2384"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Set-up.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2392C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5988 -s 680C:\Windows\SysWOW64\WerFault.exe—shark.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
27 972
Read events
27 876
Write events
94
Delete events
2

Modification events

(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\#Pa$CŌݔe--2244__OpeN-Set-UPD-PC34@!#$Patch2244.tar
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
206
Suspicious files
28
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
7560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa7560.18916\#Pa$CŌݔe--2244__OpeN-Set-UPD-PC2244@!#$Patch.7z —
MD5:—
SHA256:—
7656WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7656.19329\Set-up.exe —
MD5:—
SHA256:—
5728WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dxdiag.exe_dfcec3989f412df81657ebf72afe505ca21af_60d1b079_0ec0bf57-94b4-482c-9cf5-a5c76c2833f2\Report.wer —
MD5:—
SHA256:—
5800WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dxdiag.exe_dfcec3989f412df81657ebf72afe505ca21af_60d1b079_fa0bba98-0044-40c6-86ce-6291ebe71b7d\Report.wer —
MD5:—
SHA256:—
7280WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dxdiag.exe_dfcec3989f412df81657ebf72afe505ca21af_60d1b079_d2bfcf40-b2a9-465c-a4a2-94629761ddc8\Report.wer —
MD5:—
SHA256:—
5728WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER8442.tmp.xmlxml
MD5:AA1EB074262BA2C315160FAFF10BD9DE
SHA256:E479AAA75B5AB4AAE64E965EF9B20E6863FB95015AE616739BE7EC255D8F0D18
8092Set-up.exeC:\Users\admin\hjksfd.exeexecutable
MD5:4B43B6D5F68FA73217CD22F7E59242F8
SHA256:5F4E965FE0F6F54CD8D535EB1D225E250F3C7399AC7F4DC672B737B477A07744
5332chrome.exeC:\Users\admin\AppData\Local\Temp\Cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5800WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER875F.tmp.xmlxml
MD5:C8B1ED022AE41A91A3389B35F68762B7
SHA256:FE5EC5F8895C30B8C1E287FDE8CE7CA3E086880CD4574C062AB660525CFFD1DC
8092Set-up.exeC:\Users\admin\hjksfl.exeexecutable
MD5:60EAB9DD89607445994498C6FE0E64F9
SHA256:310CB16AB9A373164F2470369D3536B108F5CDDA57EB23F8CFE84FF375BA6559
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
55
DNS requests
26
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
304
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8092
Set-up.exe
GET
200
104.21.16.1:80
http://h1.grufflyslick.bet/sh.ext.exe.bin
unknown
—
—
unknown
8092
Set-up.exe
GET
200
104.21.16.1:80
http://h1.grufflyslick.bet/shark.bin
unknown
—
—
unknown
6592
wipe.com
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
6592
wipe.com
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
  • 184.24.77.27
  • 184.24.77.17
  • 184.24.77.19
  • 184.24.77.24
  • 184.24.77.23
  • 184.24.77.29
  • 184.24.77.28
  • 184.24.77.21
  • 184.24.77.18
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.67
  • 20.190.159.128
  • 40.126.31.71
  • 40.126.31.131
  • 20.190.159.131
  • 20.190.159.0
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
8092
Set-up.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
8092
Set-up.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
8092
Set-up.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
8092
Set-up.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
6592
wipe.com
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-2-s1 .binance .org)
5988
shark.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-2-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
#Pa$CŌݔe--2244__OpeN-Set-UPD-PC34@!#$Patch2244.tar