File name:

Setup_patched.exe

Full analysis: https://app.any.run/tasks/6801dd76-0605-4fb7-bfb1-e17cdc528402
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 10:51:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

8CE658634BAFFD1D4214750519A3764F

SHA1:

68F63428FF3C20AE5C1DABD3EA5C5E724B7E89AD

SHA256:

5903968DAE09CAF1A9042E5A0EDEF721716C5959AA9FFBC93F14DD84FC6DC3DB

SSDEEP:

98304:KVcvlP1WJ/HOM7ahoycJphg0Zax5I1/shrCm/rYCZaA/tsbLTmNx7Sc7ik/ERL9J:U5bupH5bupf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • Setup_patched.exe (PID: 7796)

    • Actions looks like stealing of personal data

      • Setup_patched.exe (PID: 7796)
      • VirtuServer128.exe (PID: 5204)

    • Executing a file with an untrusted certificate

      • hjksfhs.exe (PID: 2384)
      • hjksfxc.exe (PID: 7388)
      • DistriCompiler89.exe (PID: 7544)
      • DistriCompiler89.exe (PID: 5956)
      • DistriCompiler89.exe (PID: 2656)
      • VirtuServer128.exe (PID: 5204)

    • Known privilege escalation attack

      • dllhost.exe (PID: 5416)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Setup_patched.exe (PID: 7796)
      • hjksfhs.exe (PID: 2384)
      • DistriCompiler89.exe (PID: 2656)

    • Potential Corporate Privacy Violation

      • Setup_patched.exe (PID: 7796)

    • Executable content was dropped or overwritten

      • Setup_patched.exe (PID: 7796)
      • hjksfxc.exe (PID: 7388)
      • DistriCompiler89.exe (PID: 7544)
      • DistriCompiler89.exe (PID: 5956)
      • DistriCompiler89.exe (PID: 2656)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6516)
      • VirtuServer128.exe (PID: 5204)

    • Reads security settings of Internet Explorer

      • hjksfxc.exe (PID: 7388)
      • VirtuServer128.exe (PID: 5204)
      • MicrosoftEdgeUpdate.exe (PID: 7632)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 7544)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 5204)

    • Starts process via Powershell

      • powershell.exe (PID: 7180)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 6516)
      • MicrosoftEdgeUpdate.exe (PID: 7632)
      • VirtuServer128.exe (PID: 5204)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 5204)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7632)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 7632)

  • INFO

    • Reads the computer name

      • Setup_patched.exe (PID: 7796)
      • elevation_service.exe (PID: 8016)
      • hjksfxc.exe (PID: 7388)
      • DistriCompiler89.exe (PID: 7544)
      • DistriCompiler89.exe (PID: 5956)
      • 7za.exe (PID: 3020)
      • DistriCompiler89.exe (PID: 2656)
      • VirtuServer128.exe (PID: 5204)
      • 7za.exe (PID: 5116)
      • MicrosoftEdgeUpdate.exe (PID: 7632)

    • Checks supported languages

      • Setup_patched.exe (PID: 7796)
      • elevation_service.exe (PID: 8016)
      • hjksfhs.exe (PID: 2384)
      • hjksfxc.exe (PID: 7388)
      • DistriCompiler89.exe (PID: 5956)
      • 7za.exe (PID: 3020)
      • DistriCompiler89.exe (PID: 7544)
      • DistriCompiler89.exe (PID: 2656)
      • VirtuServer128.exe (PID: 5204)
      • 7za.exe (PID: 5116)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6516)
      • MicrosoftEdgeUpdate.exe (PID: 7632)

    • Reads the machine GUID from the registry

      • Setup_patched.exe (PID: 7796)
      • 7za.exe (PID: 3020)
      • VirtuServer128.exe (PID: 5204)

    • Executes as Windows Service

      • elevation_service.exe (PID: 8016)

    • Process checks computer location settings

      • hjksfxc.exe (PID: 7388)
      • MicrosoftEdgeUpdate.exe (PID: 7632)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 5956)
      • DistriCompiler89.exe (PID: 7544)
      • DistriCompiler89.exe (PID: 2656)
      • VirtuServer128.exe (PID: 5204)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6516)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 5956)
      • DistriCompiler89.exe (PID: 2656)

    • Compiled with Borland Delphi (YARA)

      • hjksfhs.exe (PID: 2384)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 3020)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 5416)

    • The sample compiled with english language support

      • DistriCompiler89.exe (PID: 2656)
      • VirtuServer128.exe (PID: 5204)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6516)
      • MicrosoftEdgeUpdate.exe (PID: 7632)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 5204)
      • MicrosoftEdgeUpdate.exe (PID: 7632)
      • wermgr.exe (PID: 7736)
      • slui.exe (PID: 6744)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 5204)
      • MicrosoftEdgeUpdate.exe (PID: 7632)
      • wermgr.exe (PID: 7736)
      • slui.exe (PID: 6744)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 5204)
      • wermgr.exe (PID: 7736)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 18944
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
27
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup_patched.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs hjksfhs.exe no specs hjksfxc.exe districompiler89.exe districompiler89.exe 7za.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe virtuserver128.exe slui.exe 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1760"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—Setup_patched.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2384C:\Users\admin\hjksfhs.exeC:\Users\admin\hjksfhs.exe—Setup_patched.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\hjksfhs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2656"C:\ProgramData\Iaclientv2\DistriCompiler89.exe" C:\ProgramData\Iaclientv2\DistriCompiler89.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3020"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exe—DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5116"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exe—DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5204C:\ProgramData\VirtuServer128.exeC:\ProgramData\VirtuServer128.exe
DistriCompiler89.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Updater Core Helper
Exit code:
0
Version:
9\,0\,0\,11
Modules
Images
c:\users\admin\appdata\local\temp\f597ffc.tmp
c:\programdata\virtuserver128.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Setup_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5416C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
Total events
10 308
Read events
10 257
Write events
49
Delete events
2

Modification events

(PID) Process:(7904) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7904) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7984) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7984) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(8064) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(8080) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(8172) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(8172) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
3
(PID) Process:(8184) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(8184) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
3
Executable files
213
Suspicious files
23
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7388hjksfxc.exeC:\Users\admin\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
2656DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\F597FFC.tmp —
MD5:—
SHA256:—
7388hjksfxc.exeC:\Users\admin\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
7544DistriCompiler89.exeC:\ProgramData\Iaclientv2\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
7796Setup_patched.exeC:\Users\admin\hjksfxc.exeexecutable
MD5:06CD992D7E3A5334AD400EAA61C160AB
SHA256:F86FB2936D6B0B2E6C84519734016EE8AE695457734194C6331F86D1962091DD
7388hjksfxc.exeC:\Users\admin\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
7544DistriCompiler89.exeC:\ProgramData\Iaclientv2\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
7388hjksfxc.exeC:\Users\admin\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
8172chrome.exeC:\Users\admin\AppData\Local\Temp\Cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5956DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\F203F58.tmpbinary
MD5:93BF15D2641BF7EF4BF1E3D00DC3D9DA
SHA256:9C3C6B214FCE8EF18141ACC9906069B142BB740AA27F7EEC0029EBAEBCD20768
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
45
DNS requests
22
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7236
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7236
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7796
Setup_patched.exe
GET
200
172.67.221.174:80
http://h4.ribbonsubpar.top/sh.ext.bin
unknown
—
—
unknown
7796
Setup_patched.exe
GET
200
172.67.221.174:80
http://h4.ribbonsubpar.top/shark.bin
unknown
—
—
unknown
5204
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
5204
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7736
wermgr.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7796
Setup_patched.exe
172.67.221.174:443
—
CLOUDFLARENET
US
unknown
7236
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7236
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7236
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
  • 23.216.77.22
  • 23.216.77.20
  • 23.216.77.32
  • 23.216.77.35
  • 23.216.77.21
  • 23.216.77.15
  • 23.216.77.26
  • 23.216.77.28
  • 23.216.77.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
data-seed-prebsc-1-s1.binance.org
  • 3.33.196.84
  • 15.197.198.189
unknown

Threats

PID
Process
Class
Message
7796
Setup_patched.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
7796
Setup_patched.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
7796
Setup_patched.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7796
Setup_patched.exe
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
7796
Setup_patched.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7796
Setup_patched.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
7796
Setup_patched.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7796
Setup_patched.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7796
Setup_patched.exe
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_patched.exe