File name:

Cabinet.exe

Full analysis: https://app.any.run/tasks/b35b95d1-c138-4929-bcc4-49ed39e0b379
Verdict: Malicious activity
Analysis date: June 21, 2025, 15:50:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

5455A66BF75773B92C8D491A3B8DD467

SHA1:

74A0D8EA1836B5DC2784F0F5FE64BE43E3CB1429

SHA256:

4ECE3B8B563207AB8B00126E9B7AAF4EF62B84899C008DCB43A4F9E67C90B198

SSDEEP:

98304:co5jsZHnS4TQsMDUUxeQRA+Idrp2a/TguPiFq/D6NKoVaFK7j3gT1qX6ZEZEkhZ7:wgRKoVs0Xj5ATrguTyXo7rguQ70I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Cabinet.exe (PID: 6732)

    • Reads security settings of Internet Explorer

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6900)
      • cmd.exe (PID: 1216)
      • cmd.exe (PID: 5780)

    • Starts CMD.EXE for commands execution

      • PupilCab.exe (PID: 7108)

  • INFO

    • Checks supported languages

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)
      • MonDriver.exe (PID: 5372)
      • MonDriver.exe (PID: 4576)
      • MonDriver.exe (PID: 3732)
      • MonDriver.exe (PID: 7124)
      • MonDriver.exe (PID: 472)
      • MonDriver.exe (PID: 6428)
      • MonDriver.exe (PID: 2232)
      • MonDriver.exe (PID: 2696)
      • MonDriver.exe (PID: 2160)
      • MonDriver.exe (PID: 6348)
      • MonDriver.exe (PID: 1164)
      • MonDriver.exe (PID: 2792)
      • MonDriver.exe (PID: 1520)
      • MonDriver.exe (PID: 2732)
      • MonDriver.exe (PID: 6524)
      • MonDriver.exe (PID: 1080)
      • MonDriver.exe (PID: 1944)
      • MonDriver.exe (PID: 6404)
      • MonDriver.exe (PID: 6260)
      • MonDriver.exe (PID: 2460)
      • MonDriver.exe (PID: 4512)
      • MonDriver.exe (PID: 1488)
      • MonDriver.exe (PID: 4444)
      • MonDriver.exe (PID: 5908)
      • MonDriver.exe (PID: 984)
      • MonDriver.exe (PID: 6684)
      • MonDriver.exe (PID: 6772)
      • MonDriver.exe (PID: 6160)
      • MonDriver.exe (PID: 6664)
      • MonDriver.exe (PID: 3880)
      • MonDriver.exe (PID: 4796)
      • MonDriver.exe (PID: 2492)
      • MonDriver.exe (PID: 2272)
      • MonDriver.exe (PID: 4100)

    • Reads the computer name

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)
      • MonDriver.exe (PID: 4576)
      • MonDriver.exe (PID: 5372)
      • MonDriver.exe (PID: 472)
      • MonDriver.exe (PID: 3732)
      • MonDriver.exe (PID: 7124)
      • MonDriver.exe (PID: 2696)
      • MonDriver.exe (PID: 2232)
      • MonDriver.exe (PID: 6428)
      • MonDriver.exe (PID: 1944)
      • MonDriver.exe (PID: 6348)
      • MonDriver.exe (PID: 6404)
      • MonDriver.exe (PID: 2792)
      • MonDriver.exe (PID: 2732)
      • MonDriver.exe (PID: 1520)
      • MonDriver.exe (PID: 6524)
      • MonDriver.exe (PID: 1080)
      • MonDriver.exe (PID: 2160)
      • MonDriver.exe (PID: 1164)
      • MonDriver.exe (PID: 6684)
      • MonDriver.exe (PID: 6260)
      • MonDriver.exe (PID: 2460)
      • MonDriver.exe (PID: 4512)
      • MonDriver.exe (PID: 4444)
      • MonDriver.exe (PID: 5908)
      • MonDriver.exe (PID: 1488)
      • MonDriver.exe (PID: 984)
      • MonDriver.exe (PID: 2272)
      • MonDriver.exe (PID: 6772)
      • MonDriver.exe (PID: 6664)
      • MonDriver.exe (PID: 3880)
      • MonDriver.exe (PID: 4796)
      • MonDriver.exe (PID: 2492)
      • MonDriver.exe (PID: 4100)
      • MonDriver.exe (PID: 6160)

    • The sample compiled with english language support

      • Cabinet.exe (PID: 6732)

    • Creates files in the program directory

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)

    • Compiled with Borland Delphi (YARA)

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)

    • Creates files or folders in the user directory

      • Cabinet.exe (PID: 6732)

    • Process checks computer location settings

      • Cabinet.exe (PID: 6732)
      • PupilCab.exe (PID: 7108)

    • Reads the machine GUID from the registry

      • PupilCab.exe (PID: 7108)

    • Reads the software policy settings

      • slui.exe (PID: 4824)

    • Checks proxy server information

      • slui.exe (PID: 4824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (68.6)
.exe | Win32 EXE PECompact compressed (generic) (26)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)
.exe | DOS Executable Generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:09 08:13:39+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 3478016
InitializedDataSize: 24564736
UninitializedDataSize: -
EntryPoint: 0x3527fc
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 6.0.2.1
ProductVersionNumber: 6.0.2.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: GRAND
FileDescription: Cabinet
FileVersion: 6.0.2.1
ProgramID: com.embarcadero.Cabinet
ProductName: Cabinet
ProductVersion: 6.0.2.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
115
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cabinet.exe pupilcab.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs slui.exe cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cmd.exe no specs conhost.exe no specs mondriver.exe no specs cabinet.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"cmd.exe" /c "C:\ProgramData\CabinetPupils\MonDriver.exe "C:\Windows\SysWOW64\cmd.exe—PupilCab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
472"C:\ProgramData\CabinetPupils\MonDriver.exe "C:\ProgramData\CabinetPupils\MonDriver.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
MonDriver
Exit code:
0
Version:
6.0.2.1
Modules
Images
c:\programdata\cabinetpupils\mondriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
756\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
984"C:\ProgramData\CabinetPupils\MonDriver.exe "C:\ProgramData\CabinetPupils\MonDriver.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
MonDriver
Exit code:
0
Version:
6.0.2.1
Modules
Images
c:\programdata\cabinetpupils\mondriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1080"C:\ProgramData\CabinetPupils\MonDriver.exe "C:\ProgramData\CabinetPupils\MonDriver.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
MonDriver
Exit code:
0
Version:
6.0.2.1
Modules
Images
c:\programdata\cabinetpupils\mondriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1164"C:\ProgramData\CabinetPupils\MonDriver.exe "C:\ProgramData\CabinetPupils\MonDriver.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
MonDriver
Exit code:
0
Version:
6.0.2.1
Modules
Images
c:\programdata\cabinetpupils\mondriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1212taskkill /im updCabinet.exe /fC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
6 361
Read events
6 361
Write events
0
Delete events
0

Modification events

No data
Executable files
14
Suspicious files
17
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
6732Cabinet.exeC:\ProgramData\CabinetPupils\libeay32.dllexecutable
MD5:D3AFB153011566F447E2612732D0925B
SHA256:F32E7C3FFAF3DB93DA44852C0859E5D7A53E7A638C358F6F8BBF981B5616BA6A
6732Cabinet.exeC:\ProgramData\CabinetPupils\ssleay32.dllexecutable
MD5:1CCC098E544D3EE7A619E23343F8FD35
SHA256:D4313CE3EDA3132A1B93EAE5E5E40ADD937B748B3033B24B114A390465642C25
6732Cabinet.exeC:\ProgramData\CabinetPupils\res\award_connector1.pctimage
MD5:3EB7922C3443438982CB0A4A4BEADB5A
SHA256:456EB260B29FA68442C47F8033EFEC6EEBB54D4B29D2FBF9A7E5045C1DF7796B
6732Cabinet.exeC:\ProgramData\CabinetPupils\ukr.bitbinary
MD5:C7C93BDBCDC45FE1508BE8C8DEE0356A
SHA256:FFEE8381238070717310A862BAC39A6B69C8A6C625440B6006A04B619AFA380A
6732Cabinet.exeC:\ProgramData\CabinetPupils\MonDriver.exeexecutable
MD5:29E9C03A4F4D05065DAAD1BBA21C8283
SHA256:8372B23CB712F37ABDECBD250AC5BC9D9CF3F2CE6538713C308F5881D19149BF
6732Cabinet.exeC:\ProgramData\CabinetPupils\setting.jsonbinary
MD5:1066857590947997807E281F30A18EAF
SHA256:5431062BB89FB439E75E4C58AD6C11648A5D156641608606C9EEB7E142DE8ED0
6732Cabinet.exeC:\ProgramData\CabinetPupils\PupilCab.exeexecutable
MD5:55C84EC1126646E07A090B452B4DB66C
SHA256:E3C36CBB95B78A881FD7FF2EED738A884364599F045B5C9E5E94304820BFDC10
6732Cabinet.exeC:\ProgramData\CabinetPupils\updCabinet.exeexecutable
MD5:9617A49FF7F05935F924C8DB22ED55D3
SHA256:CFCBB39263354568EA8491B0925D48499F03C4D3706A4D659D51B48FFFEBAC7F
6732Cabinet.exeC:\ProgramData\CabinetPupils\libssl32.dllexecutable
MD5:F0B439CCAD4238004001FCCA94FB24FE
SHA256:1E6FB714037D30A6809AC7D1A46F63A8BB858BF33C97AFAA3DDA0D42C337DDEC
6732Cabinet.exeC:\ProgramData\itosvita.tmptext
MD5:3E1B5546387D0FC449427FA3D5ADA90A
SHA256:F0BE3476B8F20640A510240D85D7C250D67EA29ED52AFABC1539A24DED03774E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
29
DNS requests
9
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
37.27.114.62:443
https://s3.bene.space/cabinet/app/setting20.json
unknown
binary
28.2 Kb
—
—
—
GET
200
51.79.20.123:443
https://cabinet.org.ua/upload/version.txt
unknown
text
4 b
—
—
—
GET
200
37.27.114.62:443
https://s3.bene.space/cabinet/app/backgroundmain6020.png
unknown
image
39.9 Kb
—
—
—
GET
200
37.27.114.62:443
https://s3.bene.space/cabinet/app/workout6020.png
unknown
image
23.8 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
—
—
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
cabinet.org.ua
  • 51.79.20.123
unknown
s3.bene.space
  • 37.27.114.62
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 13.89.179.13
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO HTTP POST contains pass= in cleartext
—
—
Potential Corporate Privacy Violation
ET INFO HTTP POST contains pass= in cleartext
—
—
Potential Corporate Privacy Violation
ET INFO HTTP POST contains pass= in cleartext
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Cabinet.exe