File name:

ep_setup.exe

Full analysis: https://app.any.run/tasks/9a580d6e-4eb8-4b7f-8437-94587149672f
Verdict: Malicious activity
Analysis date: June 20, 2025, 04:15:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

7F2EBE6040CCD8EAB18440AB76DB6E2C

SHA1:

83722B0918661BB73CCDBF93ED8A098161AAB379

SHA256:

3680AA912D3ED60FD4762B349701E280A3D34771B659F14809D3882ABABD64F0

SSDEEP:

98304:WS1iunCZqDzxPyTX35C22coZWH7/cZ61Zk8eXLZxZiLFNYUmlB9+T3Lwjl3N8dIR:abUnwt1LqcPB6mCNeaK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • ep_setup.exe (PID: 1688)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)

    • Reads the date of Windows installation

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Application launched itself

      • ep_setup.exe (PID: 3832)

    • Uses TASKKILL.EXE to kill process

      • ep_setup.exe (PID: 1688)

    • Starts CMD.EXE for commands execution

      • ep_setup.exe (PID: 1688)

    • Stops a currently running service

      • sc.exe (PID: 6636)
      • sc.exe (PID: 6540)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6380)
      • ep_setup.exe (PID: 1688)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5560)
      • sc.exe (PID: 6948)

    • Process drops legitimate windows executable

      • ep_setup.exe (PID: 1688)

    • Executable content was dropped or overwritten

      • ep_setup.exe (PID: 1688)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3960)
      • regsvr32.exe (PID: 4684)

    • Creates a software uninstall entry

      • ep_setup.exe (PID: 1688)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 1720)

    • The process creates files with name similar to system file names

      • ep_setup.exe (PID: 1688)

  • INFO

    • Checks supported languages

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • TextInputHost.exe (PID: 5996)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Reads the computer name

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)
      • TextInputHost.exe (PID: 5996)
      • SearchApp.exe (PID: 4924)

    • The sample compiled with english language support

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)

    • Process checks computer location settings

      • ep_setup.exe (PID: 3832)
      • ep_setup.exe (PID: 1688)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SearchApp.exe (PID: 4924)

    • Creates files in the program directory

      • ep_setup.exe (PID: 1688)

    • Checks proxy server information

      • SearchApp.exe (PID: 4924)
      • explorer.exe (PID: 1720)

    • Reads the software policy settings

      • explorer.exe (PID: 1720)
      • SearchApp.exe (PID: 4924)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1720)

    • Reads Environment values

      • SearchApp.exe (PID: 4924)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1720)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 4924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:20 22:56:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 155136
InitializedDataSize: 11911168
UninitializedDataSize: -
EntryPoint: 0x9368
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 22631.5335.68.2
ProductVersionNumber: 22631.5335.68.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ExplorerPatcher Developers
FileDescription: ExplorerPatcher Setup Program
FileVersion: 22631.5335.68.2
InternalName: ep_setup.exe
LegalCopyright: (C) 2021-2024 ExplorerPatcher Developers. All rights reserved.
OriginalFileName: ep_setup.exe
ProductName: ExplorerPatcher
ProductVersion: 22631.5335.68.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
21
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ep_setup.exe no specs ep_setup.exe taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe mobsync.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
888C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1520\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Users\admin\AppData\Local\Temp\ep_setup.exe" C:\Users\admin\AppData\Local\Temp\ep_setup.exe
ep_setup.exe
User:
admin
Company:
ExplorerPatcher Developers
Integrity Level:
HIGH
Description:
ExplorerPatcher Setup Program
Exit code:
0
Version:
22631.5335.68.2
Modules
Images
c:\users\admin\appdata\local\temp\ep_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1720"C:\WINDOWS\explorer.exe" /NoUACCheckC:\Windows\explorer.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
2292"C:\WINDOWS\system32\taskkill.exe" /f /im explorer.exeC:\Windows\System32\taskkill.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3832"C:\Users\admin\AppData\Local\Temp\ep_setup.exe" C:\Users\admin\AppData\Local\Temp\ep_setup.exe—explorer.exe
User:
admin
Company:
ExplorerPatcher Developers
Integrity Level:
MEDIUM
Description:
ExplorerPatcher Setup Program
Exit code:
0
Version:
22631.5335.68.2
Modules
Images
c:\users\admin\appdata\local\temp\ep_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3960"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"C:\Windows\System32\regsvr32.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4236C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4552"C:\WINDOWS\explorer.exe" C:\Windows\explorer.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
2
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
Total events
28 466
Read events
28 117
Write events
323
Delete events
26

Modification events

(PID) Process:(4684) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}
Operation:writeName:AppID
Value:
{A6EA9C2D-4982-4827-9204-0AC532959F6D}
(PID) Process:(4684) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4684) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}
Operation:writeName:DllSurrogate
Value:
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:UninstallString
Value:
"C:\Program Files\ExplorerPatcher\ep_setup.exe" /uninstall
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayName
Value:
ExplorerPatcher
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:Publisher
Value:
VALINET Solutions SRL
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:NoModify
Value:
1
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:NoRepair
Value:
1
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayVersion
Value:
22631.5335.68.2
(PID) Process:(1688) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:VersionMajor
Value:
68
Executable files
13
Suspicious files
98
Text files
123
Unknown types
0

Dropped files

PID
Process
Filename
Type
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_taskbar.0.dllexecutable
MD5:EAE7995886FCE950FFDD8843E3230C2F
SHA256:90BE150AE1B3FE139CCEF920A64E3A7DFED035F8C653A1F7D1013A4767E21C07
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_dwm_svc.exeexecutable
MD5:EA33A6EE4E9CEAB400FDB00EB7C3085B
SHA256:731F0D5CEB195524434EEB07C2ADBC3679077DD5DCC22E089FAF35C2A2144ED1
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_weather_host.dllexecutable
MD5:2A3D470AF752EBA165041B715D0DF701
SHA256:D691D99DA66D75133DCBA32D78EAA1E0EAE5091A235C90CDEB56E007BDDF71A1
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_setup.exeexecutable
MD5:7F2EBE6040CCD8EAB18440AB76DB6E2C
SHA256:3680AA912D3ED60FD4762B349701E280A3D34771B659F14809D3882ABABD64F0
4924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:D2D86FF9565CB8A8B9CC85C77D3CBC0A
SHA256:C31558BF2F6CDC008001D61CE76C223A4436B767E9CE2BE3B7F1667C579E37C8
4924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:A0D9628F0817C29024803905E52861E8
SHA256:6A675DE2B516273CC60752372418C4A6BD1611B4740AC51E1B584BC6EAE923B3
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_gui.dllexecutable
MD5:7052514502E0E98D05B2D37A42A179B4
SHA256:AEC6F3A38881BD183B79569A063FF86C80FFCD3BD1107C9478C4B715148B0752
1688ep_setup.exeC:\Program Files\ExplorerPatcher\WebView2Loader.dllexecutable
MD5:C5F0C46E91F354C58ECEC864614157D7
SHA256:465A7DDFB3A0DA4C3965DAF2AD6AC7548513F42329B58AEBC337311C10EA0A6F
1688ep_setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnkbinary
MD5:A9D17616782A2B421BD2439FD676BC26
SHA256:6F175C852426B26E98E7331C218717310753CBC7807893AB26CD15F82982E124
1688ep_setup.exeC:\Program Files\ExplorerPatcher\ep_weather_host_stub.dllexecutable
MD5:2D85C161D4D5DAE04BC9E7AC3567F14F
SHA256:96DCC462E0BDD894AFA43C237E34C940314E203C66C698DE277D60C2DD39F724
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
42
DNS requests
30
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
1720
explorer.exe
GET
302
204.79.197.219:80
http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/3F0945AE4BC25ECE16353588B05D30B61/twinui.pcshell.pdb
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
1720
explorer.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2028
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4924
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4924
SearchApp.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
github.com
  • 140.82.121.3
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
th.bing.com
  • 2.16.241.218
  • 2.16.241.201
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Blob Storage (.blob .core .windows .net)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Blob Storage (.blob .core .windows .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ep_setup.exe