File name:

Setup.exe

Full analysis: https://app.any.run/tasks/a032380d-6663-4979-8813-3061a303fef1
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 01, 2024, 07:49:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
telegram
stealer
vidar
ddr
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

293548F3E64884605ED1454F86CEDCD5

SHA1:

3D49595AFBFA528D9B28C24E35CDD8AF1576C4B3

SHA256:

2CF95C5C462900A24D21C26B5BCBECEEE9B10F40F2F2DB91980D9B3C5FC013A4

SSDEEP:

98304:ZZJlEgK5Yw5TYfBEdqm9XG9a9+7goWXTTbg4QRyJ6R6mGlE17BgbAZqLr8SyFxLS:fEal0E1uNqID

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 2660)
      • cmd.exe (PID: 2176)
      • Millennium.pif (PID: 3836)
      • Millennium.pif (PID: 3824)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 5076)
      • findstr.exe (PID: 3180)
      • findstr.exe (PID: 5240)
      • findstr.exe (PID: 3976)

    • Uses Task Scheduler to autorun other applications

      • Millennium.pif (PID: 3836)

    • VIDAR has been detected (SURICATA)

      • Millennium.pif (PID: 3824)

    • Starts CMD.EXE for self-deleting

      • Millennium.pif (PID: 3824)

    • Steals credentials from Web Browsers

      • Millennium.pif (PID: 3824)

    • Actions looks like stealing of personal data

      • Millennium.pif (PID: 3824)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 2660)
      • Millennium.pif (PID: 4372)
      • Setup.exe (PID: 6020)
      • Millennium.pif (PID: 3824)

    • Reads the date of Windows installation

      • Setup.exe (PID: 2660)
      • Setup.exe (PID: 6020)
      • Millennium.pif (PID: 4372)
      • Millennium.pif (PID: 3824)

    • Executing commands from ".cmd" file

      • Setup.exe (PID: 2660)
      • Setup.exe (PID: 6020)

    • Starts CMD.EXE for commands execution

      • Setup.exe (PID: 2660)
      • cmd.exe (PID: 2176)
      • Millennium.pif (PID: 4372)
      • Setup.exe (PID: 6020)
      • cmd.exe (PID: 4084)
      • Millennium.pif (PID: 3824)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2176)
      • Millennium.pif (PID: 3836)
      • Millennium.pif (PID: 3824)

    • Get information on the list of running processes

      • cmd.exe (PID: 2176)
      • cmd.exe (PID: 4084)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2176)
      • cmd.exe (PID: 4084)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2176)
      • Millennium.pif (PID: 3836)

    • The executable file from the user directory is run by the CMD process

      • Millennium.pif (PID: 4372)
      • Millennium.pif (PID: 3836)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4084)
      • cmd.exe (PID: 2176)
      • Millennium.pif (PID: 3836)

    • Application launched itself

      • cmd.exe (PID: 4084)
      • Millennium.pif (PID: 3836)
      • cmd.exe (PID: 2176)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4084)
      • cmd.exe (PID: 2176)
      • cmd.exe (PID: 5908)

    • Connects to unusual port

      • Millennium.pif (PID: 3824)

    • Searches for installed software

      • Millennium.pif (PID: 3824)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Millennium.pif (PID: 3824)

    • The process drops Mozilla's DLL files

      • Millennium.pif (PID: 3824)

    • Checks Windows Trust Settings

      • Millennium.pif (PID: 3824)

    • Process drops legitimate windows executable

      • Millennium.pif (PID: 3824)

    • The process drops C-runtime libraries

      • Millennium.pif (PID: 3824)

    • Creates file in the systems drive root

      • cmd.exe (PID: 5956)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 2660)
      • Setup.exe (PID: 6020)
      • Millennium.pif (PID: 4372)
      • Millennium.pif (PID: 3836)
      • Millennium.pif (PID: 3824)

    • Reads the computer name

      • Setup.exe (PID: 2660)
      • Setup.exe (PID: 6020)
      • Millennium.pif (PID: 4372)
      • Millennium.pif (PID: 3824)
      • Millennium.pif (PID: 3836)

    • Create files in a temporary directory

      • Setup.exe (PID: 2660)
      • Setup.exe (PID: 6020)

    • Process checks computer location settings

      • Setup.exe (PID: 2660)
      • Setup.exe (PID: 6020)
      • Millennium.pif (PID: 4372)
      • Millennium.pif (PID: 3824)

    • Reads mouse settings

      • Millennium.pif (PID: 4372)
      • Millennium.pif (PID: 3836)

    • Creates files or folders in the user directory

      • Millennium.pif (PID: 3836)
      • Millennium.pif (PID: 3824)

    • Creates files in the program directory

      • Millennium.pif (PID: 3824)

    • Reads the software policy settings

      • Millennium.pif (PID: 3824)

    • Reads the machine GUID from the registry

      • Millennium.pif (PID: 3824)

    • Reads Environment values

      • Millennium.pif (PID: 3824)

    • Reads product name

      • Millennium.pif (PID: 3824)

    • Reads CPU info

      • Millennium.pif (PID: 3824)

    • Checks proxy server information

      • Millennium.pif (PID: 3824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:20:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 29696
InitializedDataSize: 491008
UninitializedDataSize: 16896
EntryPoint: 0x38af
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 22405.508.1.0
ProductVersionNumber: 22405.508.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Store Installer
FileVersion: 22405.508.1.0
InternalName: StoreInstaller.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: StoreInstaller.exe
ProductName: Store Installer
ProductVersion: 22405.0508.01.0+f98836716b902fe22b947f518e4ebea66a0834b3
AssemblyVersion: 22405.508.1.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
34
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs millennium.pif no specs timeout.exe no specs cmd.exe conhost.exe no specs setup.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs millennium.pif timeout.exe no specs schtasks.exe no specs conhost.exe no specs millennium.pif no specs millennium.pif no specs #VIDAR millennium.pif cmd.exe no specs conhost.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1660C:\Users\admin\AppData\Local\Temp\671268\Millennium.pif C:\Users\admin\AppData\Local\Temp\671268\Millennium.pif—Millennium.pif
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Script
Exit code:
4
Version:
3, 3, 14, 2
Modules
Images
c:\users\admin\appdata\local\temp\671268\millennium.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1792timeout 15C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1992\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2176"C:\Windows\System32\cmd.exe" /c copy Keith Keith.cmd & Keith.cmdC:\Windows\SysWOW64\cmd.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2196cmd /c copy /b Hoped 671268\r C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2412cmd /c copy /b Hoped 671268\r C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2660"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Store Installer
Exit code:
0
Version:
22405.508.1.0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
10 819
Read events
10 783
Write events
36
Delete events
0

Modification events

(PID) Process:(2660) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2660) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2660) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2660) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4372) Millennium.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4372) Millennium.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4372) Millennium.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4372) Millennium.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6020) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6020) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
8
Suspicious files
28
Text files
9
Unknown types
1

Dropped files

PID
Process
Filename
Type
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Hoped —
MD5:—
SHA256:—
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Keithtext
MD5:D069611D5475E763C89E48C47DF676DD
SHA256:65E2A87C201634B46BDF1447F4A8EE8DB0B0C966656EEF12D6B077680D9D1A00
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Profitbinary
MD5:4776C2BEE8CA55BC591329B046138F8A
SHA256:99CC6C535E13CC83DD0E1936990FFC68160A1BB64F772007F9C9F7D1E1A42D92
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Bytesmp3
MD5:D6660E1C4E3031837D02C6A4B1FC4A9C
SHA256:CDF34F961BABA6FAD59E63DD4E7FCBF8BA075B57F0188ED008388E6A96727E4B
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Determinationbinary
MD5:0CB470FD10D1B4EA8ED73E3CC42DF82A
SHA256:C644DBBF6342708D21D8200E66CA9AB4F857387462B0B467B5C93F975E28779E
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Fleecebinary
MD5:1D6C4633A5A3E68611C4B6CC0E3316F2
SHA256:042C59F246A29C85E8C29D0616A1743C8A09EE3424AF8F522D77BC4EE1175D56
2196cmd.exeC:\Users\admin\AppData\Local\Temp\671268\r —
MD5:—
SHA256:—
3836Millennium.pifC:\Users\admin\AppData\Local\UrbanEco Maps\B —
MD5:—
SHA256:—
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Traumabinary
MD5:8D9BF7F34D6CE1E35C8A1A950E8B285D
SHA256:E2EBBDC0B7B84A358111E5D7ED435079281DD93B09C24D77AEFF8308EC129B5F
2660Setup.exeC:\Users\admin\AppData\Local\Temp\Grannybinary
MD5:F11FB3C835D3348CD446B5D1C8DD1006
SHA256:E6B56A5963C3959CB6AD5050CD3D4722E7F612252E0B2814F544ACF42AE6FE6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
71
DNS requests
18
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
149.154.167.99:443
https://t.me/g067n
unknown
—
12.0 Kb
unknown
—
—
GET
200
40.68.123.157:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
23.9 Kb
unknown
—
—
GET
304
40.68.123.157:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
—
—
POST
—
52.182.143.213:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
—
—
unknown
2416
SIHClient.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
POST
200
20.190.160.17:443
https://login.live.com/RST2.srf
unknown
—
—
unknown
—
—
POST
204
104.126.37.144:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
unknown
—
—
POST
200
40.126.32.72:443
https://login.live.com/RST2.srf
unknown
—
—
unknown
—
—
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
unknown
—
—
POST
400
40.126.32.72:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
—
210 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4656
SearchApp.exe
104.126.37.145:443
—
Akamai International B.V.
DE
unknown
3868
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6004
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3868
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3040
OfficeClickToRun.exe
20.44.10.122:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3824
Millennium.pif
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
unknown
3824
Millennium.pif
195.201.251.214:9000
—
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
zUKUkeBazzbMLmM.zUKUkeBazzbMLmM
  • 49.13.77.253
unknown
self.events.data.microsoft.com
  • 20.44.10.122
whitelisted
t.me
  • 149.154.167.99
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
3824
Millennium.pif
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
3824
Millennium.pif
A Network Trojan was detected
STEALER [ANY.RUN] Vidar TLS Connection Attempt
—
—
Malware Command and Control Activity Detected
SUSPICIOUS [ANY.RUN] Used Telegram website as a dead drop resolver (DDR)
3824
Millennium.pif
A suspicious string was detected
SUSPICIOUS [ANY.RUN] Sending an HTTP request body with a Base64 encoded ZIP file
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe