File name:

setup.epibrowser.exe

Full analysis: https://app.any.run/tasks/c5a4eaa8-8482-44fe-b914-e687e0c3e336
Verdict: Malicious activity
Analysis date: January 29, 2025, 08:23:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 14 sections
MD5:

810E348F281B6D41366BD0D56CE3F516

SHA1:

FFBC4B429B95B795FBDD9F78F1A14F6FCB9D7329

SHA256:

1C74305EA3DAA1843672EF7BD5FEA0FC55DCAC0D6621C5535EBC20F25BA1B8FD

SSDEEP:

98304:t1s7i0+MJU+tFLedUTtG6pH4suArUjeud3VmOA7ZlhAEVgt8P37UUI78bW9wH2z+:JMi/wn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • setup.epibrowser.exe (PID: 6280)

    • Searches for installed software

      • explorer.exe (PID: 3260)

  • INFO

    • Reads the computer name

      • setup.epibrowser.exe (PID: 6280)

    • The sample compiled with english language support

      • setup.epibrowser.exe (PID: 6280)

    • Creates files or folders in the user directory

      • setup.epibrowser.exe (PID: 6280)

    • Checks supported languages

      • setup.epibrowser.exe (PID: 6280)
      • setup.epibrowser.exe (PID: 6340)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 3260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:01 04:44:47+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 3937280
InitializedDataSize: 1039360
UninitializedDataSize: -
EntryPoint: 0x289fa0
OSVersion: 10
ImageVersion: -
SubsystemVersion: 10
Subsystem: Windows GUI
FileVersionNumber: 130.0.6723.147
ProductVersionNumber: 130.0.6723.147
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: EPI Software
FileDescription: EpiBrowser Installer
FileVersion: 130.0.6723.147
InternalName: setup
LegalCopyright: Copyright 2024 EPI Software . All rights reserved.
ProductName: EpiBrowser Installer
ProductVersion: 130.0.6723.147
CompanyShortName: EPI Software
ProductShortName: EpiBrowser Installer
LastChange: 17e1317f6960e3a0bf9dcc371613c98a6d7db701
OfficialBuild: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.epibrowser.exe no specs setup.epibrowser.exe no specs rundll32.exe no specs explorer.exe no specs COpenControlPanel no specs

Process information

PID
CMD
Path
Indicators
Parent process
3260C:\WINDOWS\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\msvcrt.dll
3772C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
5916C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6280"C:\Users\admin\AppData\Local\Temp\setup.epibrowser.exe" C:\Users\admin\AppData\Local\Temp\setup.epibrowser.exe—explorer.exe
User:
admin
Company:
EPI Software
Integrity Level:
MEDIUM
Description:
EpiBrowser Installer
Exit code:
13
Version:
130.0.6723.147
Modules
Images
c:\users\admin\appdata\local\temp\setup.epibrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6340C:\Users\admin\AppData\Local\Temp\setup.epibrowser.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\EPISoftware\EpiBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=EpiBrowser --annotation=ver=130.0.6723.147 --initial-client-data=0x2a8,0x2ac,0x2b0,0x288,0x2b4,0x7ff6bae2c158,0x7ff6bae2c164,0x7ff6bae2c170C:\Users\admin\AppData\Local\Temp\setup.epibrowser.exe—setup.epibrowser.exe
User:
admin
Company:
EPI Software
Integrity Level:
MEDIUM
Description:
EpiBrowser Installer
Exit code:
0
Version:
130.0.6723.147
Modules
Images
c:\users\admin\appdata\local\temp\setup.epibrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
16 630
Read events
16 573
Write events
54
Delete events
3

Modification events

(PID) Process:(6280) setup.epibrowser.exeKey:HKEY_CURRENT_USER\SOFTWARE\EPISoftware\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:InstallerProgress
Value:
19
(PID) Process:(6280) setup.epibrowser.exeKey:HKEY_CURRENT_USER\SOFTWARE\EPISoftware\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:InstallerResult
Value:
1
(PID) Process:(6280) setup.epibrowser.exeKey:HKEY_CURRENT_USER\SOFTWARE\EPISoftware\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:InstallerError
Value:
13
(PID) Process:(6280) setup.epibrowser.exeKey:HKEY_CURRENT_USER\SOFTWARE\EPISoftware\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:InstallerResultUIString
Value:
The installer archive is corrupted or invalid. Please download EpiStart again.
(PID) Process:(3260) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(3260) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0000000004000000030000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(3260) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Operation:writeName:Locked
Value:
1
(PID) Process:(3260) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\79\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}
Operation:writeName:Rev
Value:
0
(PID) Process:(3260) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\79\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}
Operation:writeName:FFlags
Value:
18874369
(PID) Process:(3260) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\79\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}
Operation:writeName:Vid
Value:
{0057D0E0-3573-11CF-AE69-08002B2E1262}
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6280setup.epibrowser.exeC:\Users\admin\AppData\Local\Temp\chromium_installer.logtext
MD5:67D76B4FEB270C2A335107C8CBA6BD0A
SHA256:95C38092D1268D53EA443B3D17BFC120D509B7829D4FBF5B7B67E82107A2CAF9
6280setup.epibrowser.exeC:\Users\admin\AppData\Local\EPISoftware\EpiBrowser\User Data\Crashpad\settings.datbinary
MD5:49EA644DA2129027834F23282BB757BE
SHA256:43C1C2E8A9A203CADA368AA67A13A9839276BF85D7A37C32EE554E7C0BF7E791
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6904
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6904
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3140
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.21.65.153:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
www.bing.com
  • 2.21.65.153
  • 2.21.65.132
  • 2.21.65.157
  • 2.21.65.134
  • 2.21.65.154
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
th.bing.com
  • 2.16.204.147
  • 2.16.204.152
  • 2.16.204.153
  • 2.16.204.149
  • 2.16.204.145
  • 2.16.204.151
  • 2.16.204.157
  • 2.16.204.144
  • 2.16.204.146
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.epibrowser.exe