File name:

vsetup223.exe

Full analysis: https://app.any.run/tasks/44ec82a1-e3d6-4729-a4ea-ca74631209b0
Verdict: Malicious activity
Analysis date: November 07, 2024, 12:19:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

E1EFDD655573A06F9FF200C354D7029D

SHA1:

D5140A95D5545F00220D79C07E5BC486492CE559

SHA256:

B0A00B43BB07AF77C1BB32A20A96CF22B0EB9675F4F75F88663183142FC92BE3

SSDEEP:

98304:hSHV7ljTCPHiEHxNvhtUnyMhCdmPHn4gtLUBGzrRrZ6QYO/HNclbdp3whlsEfmh4:yrC2p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • vsetup223.tmp (PID: 6156)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • vsetup223.tmp (PID: 2184)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 4348)
      • vsetup223.exe (PID: 6604)
      • vsetup223.tmp (PID: 6156)
      • vsetup223.exe (PID: 4076)
      • csc.exe (PID: 4476)
      • csc.exe (PID: 4956)

    • Process drops legitimate windows executable

      • vsetup223.tmp (PID: 6156)

    • Probably uses Microsoft diagnostics tool to execute malicious payload

      • pcwrun.exe (PID: 764)

    • Uses RUNDLL32.EXE to load library

      • msdt.exe (PID: 5944)

  • INFO

    • Checks supported languages

      • vsetup223.tmp (PID: 2184)
      • vsetup223.exe (PID: 4076)

    • Create files in a temporary directory

      • vsetup223.exe (PID: 4076)

    • Reads the computer name

      • vsetup223.tmp (PID: 2184)

    • Manual execution by a user

      • vestos.exe (PID: 5508)
      • pcwrun.exe (PID: 764)

    • Process checks computer location settings

      • vsetup223.tmp (PID: 2184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Torah Software
FileDescription: Vestos Setup
FileVersion:
LegalCopyright:
ProductName: Vestos
ProductVersion: 2.23
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
23
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start vsetup223.exe vsetup223.tmp no specs vsetup223.exe vsetup223.tmp regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs vestos.exe no specs vestos.exe no specs pcwrun.exe no specs msdt.exe no specs sdiagnhost.exe conhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs rundll32.exe no specs vestos.exe rundll32.exe no specs vestos.exe

Process information

PID
CMD
Path
Indicators
Parent process
764C:\WINDOWS\system32\pcwrun.exe "C:\Program Files (x86)\Vestos\vestos.exe" ContextMenuC:\Windows\System32\pcwrun.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Troubleshooter Invoker
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcwrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1048C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESA83A.tmp" "c:\Users\admin\AppData\Local\Temp\CSC39BE41A4EA284C748C5EC22AB547A1CF.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2184"C:\Users\admin\AppData\Local\Temp\is-5O553.tmp\vsetup223.tmp" /SL5="$9027E,1696826,54272,C:\Users\admin\Desktop\vsetup223.exe" C:\Users\admin\AppData\Local\Temp\is-5O553.tmp\vsetup223.tmp—vsetup223.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-5o553.tmp\vsetup223.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2652C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESAC90.tmp" "c:\Users\admin\AppData\Local\Temp\CSCF564A8A824B74EB38138E95C80B66DC.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
3396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3728"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\Vestos\msflxgrd.ocx"C:\Windows\SysWOW64\regsvr32.exe—vsetup223.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3732"C:\Program Files (x86)\Vestos\vestos.exe"C:\Program Files (x86)\Vestos\vestos.exe—vsetup223.tmp
User:
admin
Company:
The Drillicks
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.02.0003
Modules
Images
c:\program files (x86)\vestos\vestos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3960"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\Vestos\scrollerii.ocx"C:\Windows\SysWOW64\regsvr32.exe—vsetup223.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4076"C:\Users\admin\Desktop\vsetup223.exe" C:\Users\admin\Desktop\vsetup223.exe
explorer.exe
User:
admin
Company:
Torah Software
Integrity Level:
MEDIUM
Description:
Vestos Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\vsetup223.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4348"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\dgij4yci.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
Total events
10 325
Read events
10 245
Write events
62
Delete events
18

Modification events

(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}
Operation:delete keyName:(default)
Value:
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30}
Operation:delete keyName:(default)
Value:
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30}\InprocServer32
Operation:delete valueName:ThreadingModel
Value:
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{275DBBA0-805A-11CF-91F7-C2863C385E30}
Operation:delete keyName:(default)
Value:
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{275DBBA0-805A-11CF-91F7-C2863C385E30}\InprocServer32
Operation:delete valueName:ThreadingModel
Value:
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(3728) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib
Operation:writeName:Version
Value:
1.0
Executable files
27
Suspicious files
31
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
6156vsetup223.tmpC:\Users\admin\AppData\Local\Temp\is-FI3FP.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
4076vsetup223.exeC:\Users\admin\AppData\Local\Temp\is-5O553.tmp\vsetup223.tmpexecutable
MD5:67C5A4F36E1C91A3B85E440EDD7AD026
SHA256:99C299D6565AB53D9AF66E0146737DC0ECFBC52ECF4740825B552DB0CC4210C6
6156vsetup223.tmpC:\Program Files (x86)\Vestos\scrollerii.ocxexecutable
MD5:6F64825485852279E49A5CC9F65688AC
SHA256:E9C62A5167DB93E907163A99CC149B62AC0CB8E26C5A7B198D7662450689A653
6156vsetup223.tmpC:\Program Files (x86)\Vestos\fixed.kdfttf
MD5:5BAF82D7980F212A3FF53A2E4D7EBC5E
SHA256:BFD08A551B3CAB5B793FC32FF4765095BAEEB6A12F6952AFDDB324D5C431D36E
6156vsetup223.tmpC:\Program Files (x86)\Vestos\is-JFV10.tmpexecutable
MD5:6F64825485852279E49A5CC9F65688AC
SHA256:E9C62A5167DB93E907163A99CC149B62AC0CB8E26C5A7B198D7662450689A653
6156vsetup223.tmpC:\Program Files (x86)\Vestos\is-BSE1P.tmpbinary
MD5:5BAF82D7980F212A3FF53A2E4D7EBC5E
SHA256:BFD08A551B3CAB5B793FC32FF4765095BAEEB6A12F6952AFDDB324D5C431D36E
6156vsetup223.tmpC:\Program Files (x86)\Vestos\msflxgrd.ocxexecutable
MD5:07BAE8106A135DF779ABC46EC603EA09
SHA256:4E592240B745546C15E95E26B2547CEC86352A49EE1EF79B3E3D28DF8B5A0E70
6604vsetup223.exeC:\Users\admin\AppData\Local\Temp\is-2R74I.tmp\vsetup223.tmpexecutable
MD5:67C5A4F36E1C91A3B85E440EDD7AD026
SHA256:99C299D6565AB53D9AF66E0146737DC0ECFBC52ECF4740825B552DB0CC4210C6
6156vsetup223.tmpC:\Program Files (x86)\Vestos\is-53BGP.tmpexecutable
MD5:4309A1E4F17F925BB2B66AC12FDA46C3
SHA256:A8ECD3DD266E8E2F62006B3B40FD60569FB3EA7DB4FEE871DEC5F2BF10355CB1
6156vsetup223.tmpC:\Program Files (x86)\Vestos\vestos.exeexecutable
MD5:69082B3ED710CE76884F3F40E22699FE
SHA256:DBA39B8FB98F2AD0A090682DF6C8B2AC466CF27124DBF683D2DEE7E376B9786F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
50
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4996
sdiagnhost.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1336
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4996
sdiagnhost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.23.209.154:443
www.bing.com
Akamai International B.V.
GB
whitelisted
864
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.154
  • 2.23.209.181
  • 2.23.209.131
  • 2.23.209.144
  • 2.23.209.141
  • 2.23.209.183
  • 2.23.209.160
  • 2.23.209.135
  • 2.23.209.156
  • 2.16.204.149
  • 2.16.204.151
  • 2.16.204.145
  • 2.16.204.157
  • 2.16.204.152
  • 2.16.204.148
  • 2.16.204.143
  • 2.16.204.153
  • 2.16.204.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
  • 23.32.238.107
  • 23.32.238.153
whitelisted
www.microsoft.com
  • 23.32.185.131
  • 23.37.237.227
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.72
  • 20.190.160.20
  • 40.126.32.136
  • 20.190.160.22
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 2.16.204.149
  • 2.16.204.151
  • 2.16.204.145
  • 2.16.204.157
  • 2.16.204.152
  • 2.16.204.148
  • 2.16.204.143
  • 2.16.204.153
  • 2.16.204.146
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
Process
Message
vestos.exe
FTH: (4584): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
vestos.exe
FTH: (6500): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vsetup223.exe