File name:

winscp437setup-sponsored.exe

Full analysis: https://app.any.run/tasks/86692097-b39a-46dc-8c86-0637b7a8f3de
Verdict: Malicious activity
Analysis date: May 28, 2025, 14:21:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
winscp
rmm-tool
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

76F1968480FFA2D8AFC3CC742D0BCA1C

SHA1:

6F048A7FD16BC2CF575D90D3660747D6BE55994E

SHA256:

22886C0EB1D7180BC14E2B07B7C3C2323090C73A5107DAF0235CCECBA1ABD138

SSDEEP:

98304:vpVXFua5DsBN1tJycrHImyx0OyHk1G7h7A2+GFBmKPAgLDvVPHAbg7su/aUQN0MT:oEV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • winscp437setup-sponsored.exe (PID: 7700)
      • winscp437setup-sponsored.exe (PID: 8000)
      • WinSCP.exe (PID: 2236)
      • WinSCP.exe (PID: 6036)
      • WinSCP.exe (PID: 4696)

    • Registers / Runs the DLL via REGSVR32.EXE

      • winscp437setup-sponsored.tmp (PID: 8044)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • winscp437setup-sponsored.tmp (PID: 7788)

    • Executable content was dropped or overwritten

      • winscp437setup-sponsored.exe (PID: 7700)
      • winscp437setup-sponsored.exe (PID: 8000)
      • winscp437setup-sponsored.tmp (PID: 8044)

    • Process drops legitimate windows executable

      • winscp437setup-sponsored.tmp (PID: 8044)

    • WINSCP mutex has been found

      • winscp437setup-sponsored.tmp (PID: 8044)
      • regsvr32.exe (PID: 5640)
      • WinSCP.exe (PID: 4696)
      • WinSCP.exe (PID: 6036)
      • WinSCP.exe (PID: 2236)

    • Reads the Windows owner or organization settings

      • winscp437setup-sponsored.tmp (PID: 8044)

    • WINSCP has been detected

      • winscp437setup-sponsored.tmp (PID: 8044)
      • regsvr32.exe (PID: 5640)
      • WinSCP.exe (PID: 4696)
      • WinSCP.exe (PID: 2236)
      • WinSCP.exe (PID: 2236)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 5640)

  • INFO

    • Create files in a temporary directory

      • winscp437setup-sponsored.exe (PID: 8000)
      • winscp437setup-sponsored.exe (PID: 7700)
      • winscp437setup-sponsored.tmp (PID: 8044)

    • Reads the computer name

      • winscp437setup-sponsored.tmp (PID: 7788)
      • winscp437setup-sponsored.tmp (PID: 8044)
      • WinSCP.exe (PID: 4696)
      • WinSCP.exe (PID: 6036)

    • Checks supported languages

      • winscp437setup-sponsored.tmp (PID: 7788)
      • winscp437setup-sponsored.exe (PID: 7700)
      • winscp437setup-sponsored.exe (PID: 8000)
      • winscp437setup-sponsored.tmp (PID: 8044)
      • WinSCP.exe (PID: 4696)
      • WinSCP.exe (PID: 6036)
      • WinSCP.exe (PID: 2236)

    • Process checks computer location settings

      • winscp437setup-sponsored.tmp (PID: 7788)

    • The sample compiled with english language support

      • winscp437setup-sponsored.tmp (PID: 8044)

    • Detects InnoSetup installer (YARA)

      • winscp437setup-sponsored.exe (PID: 7700)
      • winscp437setup-sponsored.exe (PID: 8000)
      • winscp437setup-sponsored.tmp (PID: 7788)

    • Compiled with Borland Delphi (YARA)

      • winscp437setup-sponsored.tmp (PID: 7788)

    • Checks proxy server information

      • rundll32.exe (PID: 7428)

    • Creates files or folders in the user directory

      • winscp437setup-sponsored.tmp (PID: 8044)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 7428)

    • Creates files in the program directory

      • winscp437setup-sponsored.tmp (PID: 8044)

    • Creates a software uninstall entry

      • winscp437setup-sponsored.tmp (PID: 8044)

    • Manual execution by a user

      • WinSCP.exe (PID: 6036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.3.7.1679
ProductVersionNumber: 4.3.7.1679
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Martin Prikryl
FileDescription: Setup for WinSCP 4.3.7 (SFTP, FTP and SCP client)
FileVersion: 4.3.7
LegalCopyright: (c) 2000-2011 Martin Prikryl
ProductName: WinSCP
ProductVersion: 4.3.7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
11
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winscp437setup-sponsored.exe winscp437setup-sponsored.tmp no specs winscp437setup-sponsored.exe THREAT winscp437setup-sponsored.tmp rundll32.exe no specs regsvr32.exe no specs THREAT regsvr32.exe no specs THREAT winscp.exe no specs THREAT winscp.exe no specs THREAT winscp.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2236"C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterAsUrlHandlerC:\Program Files (x86)\WinSCP\WinSCP.exe
winscp437setup-sponsored.tmp
User:
admin
Company:
Martin Prikryl
Integrity Level:
HIGH
Description:
WinSCP: SFTP, FTP and SCP client
Exit code:
0
Version:
4.3.7.1679
Modules
Images
c:\program files (x86)\winscp\winscp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
4380"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"C:\Windows\SysWOW64\regsvr32.exe—winscp437setup-sponsored.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4696"C:\Program Files (x86)\WinSCP\WinSCP.exe"C:\Program Files (x86)\WinSCP\WinSCP.exe
winscp437setup-sponsored.tmp
User:
admin
Company:
Martin Prikryl
Integrity Level:
MEDIUM
Description:
WinSCP: SFTP, FTP and SCP client
Version:
4.3.7.1679
Modules
Images
c:\program files (x86)\winscp\winscp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
5640 /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"C:\Windows\System32\regsvr32.exe
regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6036"C:\Program Files (x86)\WinSCP\WinSCP.exe" C:\Program Files (x86)\WinSCP\WinSCP.exe
explorer.exe
User:
admin
Company:
Martin Prikryl
Integrity Level:
MEDIUM
Description:
WinSCP: SFTP, FTP and SCP client
Version:
4.3.7.1679
Modules
Images
c:\program files (x86)\winscp\winscp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7428RunDll32.exe "C:\Users\admin\AppData\Local\Temp\is-7V2T1.tmp\OCSetupHlp.dll",_OCPRD6OpenCandy2@16 8044C:\Windows\SysWOW64\rundll32.exe—winscp437setup-sponsored.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7700"C:\Users\admin\AppData\Local\Temp\winscp437setup-sponsored.exe" C:\Users\admin\AppData\Local\Temp\winscp437setup-sponsored.exe
explorer.exe
User:
admin
Company:
Martin Prikryl
Integrity Level:
MEDIUM
Description:
Setup for WinSCP 4.3.7 (SFTP, FTP and SCP client)
Exit code:
0
Version:
4.3.7
Modules
Images
c:\users\admin\appdata\local\temp\winscp437setup-sponsored.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7788"C:\Users\admin\AppData\Local\Temp\is-98H56.tmp\winscp437setup-sponsored.tmp" /SL5="$902EA,3018519,54272,C:\Users\admin\AppData\Local\Temp\winscp437setup-sponsored.exe" C:\Users\admin\AppData\Local\Temp\is-98H56.tmp\winscp437setup-sponsored.tmp—winscp437setup-sponsored.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-98h56.tmp\winscp437setup-sponsored.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8000"C:\Users\admin\AppData\Local\Temp\winscp437setup-sponsored.exe" /SPAWNWND=$30254 /NOTIFYWND=$902EA C:\Users\admin\AppData\Local\Temp\winscp437setup-sponsored.exe
winscp437setup-sponsored.tmp
User:
admin
Company:
Martin Prikryl
Integrity Level:
HIGH
Description:
Setup for WinSCP 4.3.7 (SFTP, FTP and SCP client)
Exit code:
0
Version:
4.3.7
Modules
Images
c:\users\admin\appdata\local\temp\winscp437setup-sponsored.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
3 373
Read events
3 132
Write events
241
Delete events
0

Modification events

(PID) Process:(5640) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E15E1D68-0D1C-49F7-BEB8-812B1E00FA60}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(5640) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Martin Prikryl\WinSCP 2\DragExt
Operation:writeName:Enable
Value:
1
(PID) Process:(5640) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
18
(PID) Process:(2236) WinSCP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCP
Operation:writeName:URL Protocol
Value:
(PID) Process:(2236) WinSCP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCP
Operation:writeName:EditFlags
Value:
2
(PID) Process:(2236) WinSCP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCP
Operation:writeName:BrowserFlags
Value:
8
(PID) Process:(2236) WinSCP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SFTP
Operation:writeName:URL Protocol
Value:
(PID) Process:(2236) WinSCP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SFTP
Operation:writeName:EditFlags
Value:
2
(PID) Process:(2236) WinSCP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SFTP
Operation:writeName:BrowserFlags
Value:
8
(PID) Process:(2236) WinSCP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Configuration\Interface
Operation:writeName:RandomSeedFile
Value:
%25APPDATA%25%5Cwinscp.rnd
Executable files
18
Suspicious files
2
Text files
6
Unknown types
8

Dropped files

PID
Process
Filename
Type
8044winscp437setup-sponsored.tmpC:\Users\admin\AppData\Local\Temp\is-7V2T1.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
8044winscp437setup-sponsored.tmpC:\Program Files (x86)\WinSCP\WinSCP.comexecutable
MD5:96A13A54310B6D579E9A16E2249E9BBC
SHA256:008CB8E55FEA460C925046D56FEE46C9124AE379813E98D0CCBDA1AE3BF817E2
8044winscp437setup-sponsored.tmpC:\Program Files (x86)\WinSCP\is-0CSQ1.tmpexecutable
MD5:96A13A54310B6D579E9A16E2249E9BBC
SHA256:008CB8E55FEA460C925046D56FEE46C9124AE379813E98D0CCBDA1AE3BF817E2
7700winscp437setup-sponsored.exeC:\Users\admin\AppData\Local\Temp\is-98H56.tmp\winscp437setup-sponsored.tmpexecutable
MD5:D8F7D8678CCBC6C35AEA8A1E6EC40F52
SHA256:8D19BCC18CD9856BE0E341BA2EB4C8E7441AD12CCC11BC23C4B7AFE0AF791BF1
8044winscp437setup-sponsored.tmpC:\Program Files (x86)\WinSCP\unins000.exeexecutable
MD5:D8F7D8678CCBC6C35AEA8A1E6EC40F52
SHA256:8D19BCC18CD9856BE0E341BA2EB4C8E7441AD12CCC11BC23C4B7AFE0AF791BF1
8044winscp437setup-sponsored.tmpC:\Program Files (x86)\WinSCP\is-VPGJ1.tmpexecutable
MD5:D8F7D8678CCBC6C35AEA8A1E6EC40F52
SHA256:8D19BCC18CD9856BE0E341BA2EB4C8E7441AD12CCC11BC23C4B7AFE0AF791BF1
8044winscp437setup-sponsored.tmpC:\Program Files (x86)\WinSCP\is-RO1HA.tmpexecutable
MD5:495EF243E1165D63B2D8A6D4BD939602
SHA256:62A1F4B858C18ECBE4F99A595FA26387F6AEB85C23965B7870F830A5C5697D28
8044winscp437setup-sponsored.tmpC:\Users\admin\AppData\Local\Temp\is-7V2T1.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
8000winscp437setup-sponsored.exeC:\Users\admin\AppData\Local\Temp\is-9EADC.tmp\winscp437setup-sponsored.tmpexecutable
MD5:D8F7D8678CCBC6C35AEA8A1E6EC40F52
SHA256:8D19BCC18CD9856BE0E341BA2EB4C8E7441AD12CCC11BC23C4B7AFE0AF791BF1
8044winscp437setup-sponsored.tmpC:\Users\admin\AppData\Local\Temp\is-7V2T1.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
12
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4220
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4220
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4220
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
4220
SIHClient.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4220
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7600
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.130
  • 20.190.160.131
  • 40.126.32.136
  • 20.190.160.14
  • 20.190.160.66
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
opencandy.winscp.net
  • —
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winscp437setup-sponsored.exe