File name:

ep_setup.exe

Full analysis: https://app.any.run/tasks/9a580d6e-4eb8-4b7f-8437-94587149672f
Verdict: Malicious activity
Analysis date: June 20, 2025, 04:15:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

7F2EBE6040CCD8EAB18440AB76DB6E2C

SHA1:

83722B0918661BB73CCDBF93ED8A098161AAB379

SHA256:

3680AA912D3ED60FD4762B349701E280A3D34771B659F14809D3882ABABD64F0

SSDEEP:

98304:WS1iunCZqDzxPyTX35C22coZWH7/cZ61Zk8eXLZxZiLFNYUmlB9+T3Lwjl3N8dIR:abUnwt1LqcPB6mCNeaK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • ep_setup.exe (PID: 1688)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Reads security settings of Internet Explorer

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)

    • Application launched itself

      • ep_setup.exe (PID: 3832)

    • Uses TASKKILL.EXE to kill process

      • ep_setup.exe (PID: 1688)

    • Starts CMD.EXE for commands execution

      • ep_setup.exe (PID: 1688)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6380)
      • ep_setup.exe (PID: 1688)

    • Stops a currently running service

      • sc.exe (PID: 6636)
      • sc.exe (PID: 6540)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5560)
      • sc.exe (PID: 6948)

    • Executable content was dropped or overwritten

      • ep_setup.exe (PID: 1688)

    • Process drops legitimate windows executable

      • ep_setup.exe (PID: 1688)

    • Creates a software uninstall entry

      • ep_setup.exe (PID: 1688)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 4684)
      • regsvr32.exe (PID: 3960)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 1720)

    • The process creates files with name similar to system file names

      • ep_setup.exe (PID: 1688)

  • INFO

    • The sample compiled with english language support

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)

    • Reads the computer name

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • TextInputHost.exe (PID: 5996)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Process checks computer location settings

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Creates files in the program directory

      • ep_setup.exe (PID: 1688)

    • Checks supported languages

      • ep_setup.exe (PID: 1688)
      • ep_setup.exe (PID: 3832)
      • TextInputHost.exe (PID: 5996)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 4924)

    • Reads the software policy settings

      • explorer.exe (PID: 1720)
      • SearchApp.exe (PID: 4924)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1720)

    • Checks proxy server information

      • explorer.exe (PID: 1720)
      • SearchApp.exe (PID: 4924)

    • Reads Environment values

      • SearchApp.exe (PID: 4924)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:20 22:56:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 155136
InitializedDataSize: 11911168
UninitializedDataSize: -
EntryPoint: 0x9368
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 22631.5335.68.2
ProductVersionNumber: 22631.5335.68.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ExplorerPatcher Developers
FileDescription: ExplorerPatcher Setup Program
FileVersion: 22631.5335.68.2
InternalName: ep_setup.exe
LegalCopyright: (C) 2021-2024 ExplorerPatcher Developers. All rights reserved.
OriginalFileName: ep_setup.exe
ProductName: ExplorerPatcher
ProductVersion: 22631.5335.68.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
21
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ep_setup.exe no specs ep_setup.exe taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe mobsync.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
888C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1520\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Users\admin\AppData\Local\Temp\ep_setup.exe" C:\Users\admin\AppData\Local\Temp\ep_setup.exe
ep_setup.exe
User:
admin
Company:
ExplorerPatcher Developers
Integrity Level:
HIGH
Description:
ExplorerPatcher Setup Program
Exit code:
0
Version:
22631.5335.68.2
Modules
Images
c:\users\admin\appdata\local\temp\ep_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1720"C:\WINDOWS\explorer.exe" /NoUACCheckC:\Windows\explorer.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
2292"C:\WINDOWS\system32\taskkill.exe" /f /im explorer.exeC:\Windows\System32\taskkill.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3832"C:\Users\admin\AppData\Local\Temp\ep_setup.exe" C:\Users\admin\AppData\Local\Temp\ep_setup.exe—explorer.exe
User:
admin
Company:
ExplorerPatcher Developers
Integrity Level:
MEDIUM
Description:
ExplorerPatcher Setup Program
Exit code:
0
Version:
22631.5335.68.2
Modules
Images
c:\users\admin\appdata\local\temp\ep_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3960"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"C:\Windows\System32\regsvr32.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4236C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4552"C:\WINDOWS\explorer.exe" C:\Windows\explorer.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
2
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
Total events
28 466
Read events
28 117
Write events
323
Delete events
26

Modification events

(PID) Process:(4684) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}
Operation:writeName:AppID
Value:
{A6EA9C2D-4982-4827-9204-0AC532959F6D}
(PID) Process:(4684) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4684) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}
Operation:writeName:DllSurrogate
Value:
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:UninstallString
Value:
"C:\Program Files\ExplorerPatcher\ep_setup.exe" /uninstall
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayName
Value:
ExplorerPatcher
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:Publisher
Value:
VALINET Solutions SRL
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:NoModify
Value:
1
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:NoRepair
Value:
1
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayVersion
Value:
22631.5335.68.2
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:VersionMajor
Value:
68
Executable files
13
Suspicious files
98
Text files
123
Unknown types
0

Dropped files

PID
Process
Filename
Type
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dllexecutable
MD5:0608A10C6980A17B6E62F3D03E09604F
SHA256:8C5CEE228E8E23FABA7B36CEEF3CB43D71C976C4E3467BD772ABEBB799CD7D4F
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_dwm_svc.exeexecutable
MD5:EA33A6EE4E9CEAB400FDB00EB7C3085B
SHA256:731F0D5CEB195524434EEB07C2ADBC3679077DD5DCC22E089FAF35C2A2144ED1
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_setup.exeexecutable
MD5:7F2EBE6040CCD8EAB18440AB76DB6E2C
SHA256:3680AA912D3ED60FD4762B349701E280A3D34771B659F14809D3882ABABD64F0
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_weather_host.dllexecutable
MD5:2A3D470AF752EBA165041B715D0DF701
SHA256:D691D99DA66D75133DCBA32D78EAA1E0EAE5091A235C90CDEB56E007BDDF71A1
1688ep_setup.exeC:\Windows\dxgi.dllexecutable
MD5:690F951DFE65E766AF5009FC77A4357D
SHA256:5BC349B857A87DCC86D8DBBA9814DB45E17AC6B169A3A2A55FCC7371011AD34D
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dllexecutable
MD5:3CE3D794438B9195C15153D6DA846280
SHA256:956C9402CFD4AE756881B6B5A7697194A384C518B72E938F89B30C18902E319F
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_gui.dllexecutable
MD5:7052514502E0E98D05B2D37A42A179B4
SHA256:AEC6F3A38881BD183B79569A063FF86C80FFCD3BD1107C9478C4B715148B0752
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_weather_host_stub.dllexecutable
MD5:2D85C161D4D5DAE04BC9E7AC3567F14F
SHA256:96DCC462E0BDD894AFA43C237E34C940314E203C66C698DE277D60C2DD39F724
1688ep_setup.exeC:\Program Files\ExplorerPatcher\WebView2Loader.dllexecutable
MD5:C5F0C46E91F354C58ECEC864614157D7
SHA256:465A7DDFB3A0DA4C3965DAF2AD6AC7548513F42329B58AEBC337311C10EA0A6F
4924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:A0D9628F0817C29024803905E52861E8
SHA256:6A675DE2B516273CC60752372418C4A6BD1611B4740AC51E1B584BC6EAE923B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
42
DNS requests
30
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
1720
explorer.exe
GET
302
204.79.197.219:80
http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/3F0945AE4BC25ECE16353588B05D30B61/twinui.pcshell.pdb
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
1720
explorer.exe
GET
302
204.79.197.219:80
http://msdl.microsoft.com/download/symbols/StartUI.pdb/0B81EEDEEB6FF49A7EC7F23C15C216771/StartUI.pdb
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2028
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4924
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4924
SearchApp.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
github.com
  • 140.82.121.3
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
th.bing.com
  • 2.16.241.218
  • 2.16.241.201
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Blob Storage (.blob .core .windows .net)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Blob Storage (.blob .core .windows .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ep_setup.exe