File name:

Step 3 - Setup_Install.exe

Full analysis: https://app.any.run/tasks/32d0f456-2158-49b0-b41c-ab47c8a5c097
Verdict: Malicious activity
Analysis date: October 24, 2024, 13:56:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A0023254D52F0F0AE306EAA788F4D628

SHA1:

43C3058F6C9F64BCC7DA8F2D8E0A5DA0076B4948

SHA256:

383ED6C9CDF8590845730198DFDE66CD799EC047CA8850CB5ECDFED293FA287C

SSDEEP:

98304:CO7UY7BGRmoqWseW/sygVXIGdPdxy5sYOvYDNBzAUpXc/5jZDPBpjhPbh896J45A:VBNmt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 4516)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6224)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Step 3 - Setup_Install.exe (PID: 5616)
      • WindowsService.exe (PID: 7516)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6312)
      • Step 3 - Setup_Install.exe (PID: 5616)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 4516)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 4516)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 4516)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 4516)

    • Drops a system driver (possible attempt to evade defenses)

      • WindowsService.exe (PID: 7516)

    • Connects to unusual port

      • WindowsService.exe (PID: 7516)

    • Process drops legitimate windows executable

      • Step 3 - Setup_Install.exe (PID: 5616)

  • INFO

    • Creates files or folders in the user directory

      • Step 3 - Setup_Install.exe (PID: 5616)

    • Reads the computer name

      • Step 3 - Setup_Install.exe (PID: 5616)
      • msiexec.exe (PID: 6312)
      • msiexec.exe (PID: 2692)

    • Checks supported languages

      • Step 3 - Setup_Install.exe (PID: 5616)
      • msiexec.exe (PID: 6312)
      • msiexec.exe (PID: 2692)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6312)

    • Create files in a temporary directory

      • Step 3 - Setup_Install.exe (PID: 5616)

    • Reads Environment values

      • Step 3 - Setup_Install.exe (PID: 5616)
      • msiexec.exe (PID: 2692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:15 13:33:00+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.37
CodeSize: 2604032
InitializedDataSize: 1423360
UninitializedDataSize: -
EntryPoint: 0x1f0aa6
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Getintopc.com
FileDescription: EXE - Step 3 - Setup_Install Installer
FileVersion: 1.0.0
InternalName: Step 3 - Setup_Install
LegalCopyright: Copyright (C) 2024 Getintopc.com
OriginalFileName: Step 3 - Setup_Install.exe
ProductName: EXE - Step 3 - Setup_Install
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
13
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start step 3 - setup_install.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs powershell.exe no specs conhost.exe no specs windowsservice.exe conhost.exe no specs rundll32.exe no specs Shell Security Editor no specs step 3 - setup_install.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2692C:\Windows\syswow64\MsiExec.exe -Embedding CA1579F45209D8B67174A333DAB71E93 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4516C:\Windows\syswow64\MsiExec.exe -Embedding 32A60C0645A0705A6913A4353BC8AF8F E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5584"C:\Users\admin\AppData\Local\Temp\Step 3 - Setup_Install.exe" C:\Users\admin\AppData\Local\Temp\Step 3 - Setup_Install.exe—explorer.exe
User:
admin
Company:
Getintopc.com
Integrity Level:
MEDIUM
Description:
EXE - Step 3 - Setup_Install Installer
Exit code:
3221226540
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\step 3 - setup_install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5616"C:\Users\admin\AppData\Local\Temp\Step 3 - Setup_Install.exe" C:\Users\admin\AppData\Local\Temp\Step 3 - Setup_Install.exe
explorer.exe
User:
admin
Company:
Getintopc.com
Integrity Level:
HIGH
Description:
EXE - Step 3 - Setup_Install Installer
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\step 3 - setup_install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\imagehlp.dll
5952"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Roaming\Getintopc.com\EXE - Step 3 - Setup_Install 1.0.0\install\A9F990C\GetintoPC-Top-EXE.msi" /quiet /qn AI_SETUPEXEPATH="C:\Users\admin\AppData\Local\Temp\Step 3 - Setup_Install.exe" SETUPEXEDIR=C:\Users\admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1729777628 " AI_EUIMSI=""C:\Windows\SysWOW64\msiexec.exe—Step 3 - Setup_Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6224 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\WINDOWS\SystemTemp\pssFC5D.ps1" -propFile "C:\WINDOWS\SystemTemp\msiFC4B.txt" -scriptFile "C:\WINDOWS\SystemTemp\scrFC5B.ps1" -scriptArgsFile "C:\WINDOWS\SystemTemp\scrFC5C.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6312C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6988C:\Windows\syswow64\MsiExec.exe -Embedding BA99FDDC579BD22C45000F8E2913317FC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7516"C:\Users\admin\AppData\Local\Updates\WindowsService.exe"C:\Users\admin\AppData\Local\Updates\WindowsService.exe
msiexec.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\updates\windowsservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
6 963
Read events
6 932
Write events
20
Delete events
11

Modification events

(PID) Process:(6312) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A8180000B951F0931C26DB01
(PID) Process:(6312) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
EE81D9C721F1709D04087F591B4370F7CF577F91F41AC894CEF0724D2BDFCCD9
(PID) Process:(6312) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(6312) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(6312) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\8f70d.rbs
Value:
31139356
(PID) Process:(6312) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\8f70d.rbsLow
Value:
(PID) Process:(6312) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AEC9905082166A41AE800A133AA11EE
Operation:writeName:BF8B869D6524AE643A392D53AEF999C0
Value:
C:\Program Files (x86)\Getintopc.com\EXE - Step 3 - Setup_Install\
(PID) Process:(6312) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B0D81A4A3166692499415EA8808C2636
Operation:writeName:BF8B869D6524AE643A392D53AEF999C0
Value:
02:\Software\Getintopc.com\EXE - Step 3 - Setup_Install\Version
(PID) Process:(6312) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBF36D1F3800964284AF8DF83CE4E9A
Operation:writeName:BF8B869D6524AE643A392D53AEF999C0
Value:
C:\Users\admin\AppData\Local\Updates\WindowsService.exe
Executable files
17
Suspicious files
10
Text files
6
Unknown types
8

Dropped files

PID
Process
Filename
Type
5616Step 3 - Setup_Install.exeC:\Users\admin\AppData\Local\Temp\MSIF652.tmpexecutable
MD5:5A1F2196056C0A06B79A77AE981C7761
SHA256:52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
4516msiexec.exeC:\Windows\SystemTemp\msiFC4B.txt —
MD5:—
SHA256:—
4516msiexec.exeC:\Windows\SystemTemp\scrFC5B.ps1 —
MD5:—
SHA256:—
4516msiexec.exeC:\Windows\SystemTemp\scrFC5C.txt —
MD5:—
SHA256:—
4516msiexec.exeC:\Windows\SystemTemp\pssFC5D.ps1 —
MD5:—
SHA256:—
5616Step 3 - Setup_Install.exeC:\Users\admin\AppData\Local\Temp\shiF47B.tmpexecutable
MD5:84A34BF3486F7B9B7035DB78D78BDD1E
SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E
5616Step 3 - Setup_Install.exeC:\Users\admin\AppData\Local\Temp\MSIF603.tmpexecutable
MD5:5A1F2196056C0A06B79A77AE981C7761
SHA256:52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
5616Step 3 - Setup_Install.exeC:\Users\admin\AppData\Roaming\Getintopc.com\EXE - Step 3 - Setup_Install 1.0.0\install\holder0.aiphgmc
MD5:CFE6990A2F2B0B5EC97664C0C1254941
SHA256:7A969B59C111DD71554D970CB44E87EABB8E30EF0A651882EC92AF7DE5070D21
5616Step 3 - Setup_Install.exeC:\Users\admin\AppData\Local\Temp\MSIF508.tmpexecutable
MD5:5A1F2196056C0A06B79A77AE981C7761
SHA256:52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
5616Step 3 - Setup_Install.exeC:\Users\admin\AppData\Roaming\Getintopc.com\EXE - Step 3 - Setup_Install 1.0.0\install\A9F990C\GetintoPC-Top-EXE.msiexecutable
MD5:412AB643D36494C1BEE50FA456BB7E72
SHA256:BD0D85EE49DFE1715698BB723F8B451E8A3E95CE8B2191C9D56227F593665218
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
69
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6088
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3964
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7832
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7832
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
104.126.37.186:443
—
Akamai International B.V.
DE
unknown
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3608
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6088
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6088
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 2.19.198.43
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 104.126.37.176
  • 104.126.37.163
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.161
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.178
whitelisted
www.google.com.ez3oti0gayld2ksc.fast-dns-host.com
  • 188.138.25.13
  • 188.138.125.57
  • 188.138.125.61
unknown
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Step 3 - Setup_Install.exe