File name:

Setup.exe

Full analysis: https://app.any.run/tasks/b3ae87e2-5c61-435b-9f1b-0fbd5a2904bd
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:23:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

3E0AFBBD0D8471FAF9132164E7793E65

SHA1:

9D9A718285086CE6FEE84006073DEBC498354B95

SHA256:

6B661390D2E27A668F7F6D8A04D6E448369478598AB4495EB2AE6D29B50996F4

SSDEEP:

196608:SqhqoOls5O3njT0xgeZ/+M7TBMwkV1qoOls5O3njT0xgeZ/+M7TBMwkVQ:SqzOl13jTM7KwkVOl13jTM7Kwkq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 3240)
      • hjksfi.exe (PID: 4784)
      • hjksfs.exe (PID: 6824)
      • DistriCompiler89.exe (PID: 4688)
      • DistriCompiler89.exe (PID: 5084)
      • DistriCompiler89.exe (PID: 5968)
      • VirtuServer128.exe (PID: 4608)

    • Steals credentials from Web Browsers

      • Setup.exe (PID: 3240)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 3240)
      • VirtuServer128.exe (PID: 4608)

    • Known privilege escalation attack

      • dllhost.exe (PID: 2344)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3024)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Setup.exe (PID: 3240)
      • hjksfi.exe (PID: 4784)
      • DistriCompiler89.exe (PID: 5968)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 3240)
      • hjksfs.exe (PID: 6824)
      • DistriCompiler89.exe (PID: 5084)
      • DistriCompiler89.exe (PID: 4688)
      • hjksfi.exe (PID: 4784)
      • DistriCompiler89.exe (PID: 5968)
      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4040)

    • Potential Corporate Privacy Violation

      • Setup.exe (PID: 3240)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 3240)
      • hjksfs.exe (PID: 6824)
      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 4300)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 4688)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 5084)

    • Starts CMD.EXE for commands execution

      • hjksfi.exe (PID: 4784)

    • Executes application which crashes

      • hjksfi.exe (PID: 4784)

    • Process drops legitimate windows executable

      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4040)
      • MicrosoftEdgeUpdate.exe (PID: 4300)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 4608)

    • Starts process via Powershell

      • powershell.exe (PID: 4284)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 4608)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 4300)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 4300)

  • INFO

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 3240)
      • 7za.exe (PID: 5024)
      • VirtuServer128.exe (PID: 4608)

    • The sample compiled with english language support

      • Setup.exe (PID: 3240)
      • DistriCompiler89.exe (PID: 4688)
      • DistriCompiler89.exe (PID: 5968)
      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 4300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4040)

    • Checks supported languages

      • Setup.exe (PID: 3240)
      • elevation_service.exe (PID: 2564)
      • hjksfi.exe (PID: 4784)
      • hjksfs.exe (PID: 6824)
      • DistriCompiler89.exe (PID: 5084)
      • DistriCompiler89.exe (PID: 4688)
      • DistriCompiler89.exe (PID: 5968)
      • 7za.exe (PID: 5024)
      • 7za.exe (PID: 3332)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4040)
      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 4300)

    • Reads the computer name

      • Setup.exe (PID: 3240)
      • elevation_service.exe (PID: 2564)
      • hjksfs.exe (PID: 6824)
      • DistriCompiler89.exe (PID: 5084)
      • DistriCompiler89.exe (PID: 4688)
      • 7za.exe (PID: 5024)
      • DistriCompiler89.exe (PID: 5968)
      • 7za.exe (PID: 3332)
      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 4300)

    • Executes as Windows Service

      • elevation_service.exe (PID: 2564)

    • Process checks computer location settings

      • Setup.exe (PID: 3240)
      • hjksfs.exe (PID: 6824)
      • MicrosoftEdgeUpdate.exe (PID: 4300)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 5084)
      • DistriCompiler89.exe (PID: 4688)
      • hjksfi.exe (PID: 4784)
      • DistriCompiler89.exe (PID: 5968)
      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4040)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 4688)
      • DistriCompiler89.exe (PID: 5968)

    • Compiled with Borland Delphi (YARA)

      • hjksfi.exe (PID: 4784)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 5024)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2344)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • hjksfi.exe (PID: 4784)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 4300)
      • wermgr.exe (PID: 3020)
      • slui.exe (PID: 6740)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 4300)
      • wermgr.exe (PID: 3020)
      • slui.exe (PID: 6740)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 4608)
      • wermgr.exe (PID: 3020)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 4300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:07:27 13:47:44+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 738816
InitializedDataSize: 544768
UninitializedDataSize: -
EntryPoint: 0x580fc
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.0.0.11
ProductVersionNumber: 4.0.0.11
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Perspective Software
FileDescription: Setup Launcher Unicode
FileVersion: 4.0.0.11
InternalName: Setup
LegalCopyright: Copyright (c) 2015 Flexera Software LLC. All Rights Reserved.
OriginalFileName: InstallShield Setup.exe
ProductName: Blue Iris ActiveX Control
ProductVersion: 4.0.0.11
InternalBuildNumber: 176888
ISInternalVersion: 22.0.401
ISInternalDescription: Setup Launcher Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
37
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs hjksfi.exe hjksfs.exe districompiler89.exe districompiler89.exe 7za.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe werfault.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs virtuserver128.exe werfault.exe no specs 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1276C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4784 -s 660C:\Windows\SysWOW64\WerFault.exe—hjksfi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1312\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4784 -s 592C:\Windows\SysWOW64\WerFault.exe—hjksfi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2064C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4784 -s 740C:\Windows\SysWOW64\WerFault.exe—hjksfi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2100C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4784 -s 636C:\Windows\SysWOW64\WerFault.exe—hjksfi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2344C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2564"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\rpcrt4.dll
2616"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—Setup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3020"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "4300" "1112" "1996" "1888" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
12 798
Read events
12 746
Write events
50
Delete events
2

Modification events

(PID) Process:(5064) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5064) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6388) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6388) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5984) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(5964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(6620) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(6620) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
3
(PID) Process:(3332) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(3332) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
3
Executable files
214
Suspicious files
24
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5984chrome.exeC:\Users\admin\AppData\Local\Temp\Login Databinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
6620chrome.exeC:\Users\admin\AppData\Local\Temp\Cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
6824hjksfs.exeC:\Users\admin\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
5968DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\F92C12B.tmp —
MD5:—
SHA256:—
3240Setup.exeC:\Users\admin\hjksfi.exeexecutable
MD5:7019B60173E7DE285F19621945DEDF25
SHA256:25A375F5CBA3DCE4024BC78F7D4768A83CF09A64DDB971BD10C87FA97E4A5D65
6824hjksfs.exeC:\Users\admin\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
6824hjksfs.exeC:\Users\admin\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
6824hjksfs.exeC:\Users\admin\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
6824hjksfs.exeC:\Users\admin\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
5084DistriCompiler89.exeC:\ProgramData\Iaclientv2\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
47
DNS requests
23
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4068
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4068
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3240
Setup.exe
GET
200
172.67.221.174:80
http://h4.tykeblot.today/shark.bin
unknown
—
—
unknown
3240
Setup.exe
GET
200
172.67.221.174:80
http://h4.tykeblot.today/sh.ext.bin
unknown
—
—
unknown
4608
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
4608
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
3020
wermgr.exe
GET
200
23.48.23.188:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5024
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
  • 23.48.23.188
  • 23.48.23.169
  • 23.48.23.183
  • 23.48.23.181
  • 23.48.23.185
  • 23.48.23.177
  • 23.48.23.179
  • 23.48.23.180
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.14
  • 20.190.160.64
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
3240
Setup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3240
Setup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3240
Setup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3240
Setup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
4608
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe