File name:

Everything-1.4.1.1026.x86-Setup.exe

Full analysis: https://app.any.run/tasks/5756f37b-93a1-4640-8c00-70a19e819028
Verdict: Malicious activity
Analysis date: May 15, 2025, 05:27:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
everything
tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F81112D40609B97330688098222EF1FB

SHA1:

092F5B3F4F7B437923E4CBAF2DD12A6D793A32B0

SHA256:

BBF249AB7D4EA4B17A56D2EFFCD0DF563BF4D5CD4F6E00EBF5E74A74CA0034E2

SSDEEP:

98304:2J8729ADeMuoR/oRPZUwu82y/wjubr9r1ycaFQqjgP6Sw6k2/vw1813w1KXFkeAL:20UfhOT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)
      • Everything.exe (PID: 7740)

    • Changes the autorun value in the registry

      • Everything.exe (PID: 7788)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)
      • Everything.exe (PID: 7740)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)

    • The process creates files with name similar to system file names

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)

    • There is functionality for taking screenshot (YARA)

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)
      • Everything.exe (PID: 7816)
      • Everything.exe (PID: 7928)

    • Reads security settings of Internet Explorer

      • Everything.exe (PID: 7604)
      • Everything.exe (PID: 7740)

    • Application launched itself

      • Everything.exe (PID: 7604)

    • Creates a software uninstall entry

      • Everything.exe (PID: 7740)

    • Starts itself from another location

      • Everything.exe (PID: 7740)

    • Executes as Windows Service

      • Everything.exe (PID: 7816)

  • INFO

    • The sample compiled with english language support

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)
      • Everything.exe (PID: 7740)

    • Reads the computer name

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)
      • Everything.exe (PID: 7604)
      • Everything.exe (PID: 7740)
      • Everything.exe (PID: 7788)
      • Everything.exe (PID: 7816)
      • Everything.exe (PID: 7848)
      • Everything.exe (PID: 7928)

    • Checks supported languages

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)
      • Everything.exe (PID: 7604)
      • Everything.exe (PID: 7740)
      • Everything.exe (PID: 7788)
      • Everything.exe (PID: 7848)
      • Everything.exe (PID: 7816)
      • Everything.exe (PID: 7928)

    • Create files in a temporary directory

      • Everything-1.4.1.1026.x86-Setup.exe (PID: 6824)

    • Process checks computer location settings

      • Everything.exe (PID: 7604)
      • Everything.exe (PID: 7740)

    • Creates files in the program directory

      • Everything.exe (PID: 7740)
      • Everything.exe (PID: 7788)

    • Creates files or folders in the user directory

      • Everything.exe (PID: 7848)

    • EVERYTHING mutex has been found

      • Everything.exe (PID: 7928)

    • Reads the software policy settings

      • slui.exe (PID: 1056)
      • slui.exe (PID: 7172)

    • Checks proxy server information

      • slui.exe (PID: 1056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.1026
ProductVersionNumber: 1.4.1.1026
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Everything Setup
FileVersion: 1.4.1.1026
LegalCopyright: Copyright (c) 2024 voidtools
LegalTrademarks: -
ProductName: Everything
ProductVersion: 1.4.1.1026
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #GENERIC everything-1.4.1.1026.x86-setup.exe sppextcomobj.exe no specs slui.exe everything.exe no specs #GENERIC everything.exe everything.exe everything.exe no specs everything.exe no specs everything.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
664C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1056C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6824"C:\Users\admin\AppData\Local\Temp\Everything-1.4.1.1026.x86-Setup.exe" C:\Users\admin\AppData\Local\Temp\Everything-1.4.1.1026.x86-Setup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Everything Setup
Exit code:
0
Version:
1.4.1.1026
Modules
Images
c:\users\admin\appdata\local\temp\everything-1.4.1.1026.x86-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7172"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7604"C:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"C:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\Everything.exe—Everything-1.4.1.1026.x86-Setup.exe
User:
admin
Company:
voidtools
Integrity Level:
MEDIUM
Description:
Everything
Exit code:
0
Version:
1.4.1.1026
Modules
Images
c:\users\admin\appdata\local\temp\nsxc8b3.tmp\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7740"C:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\Everything.exe" -isrunas -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"C:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\Everything.exe
Everything.exe
User:
admin
Company:
voidtools
Integrity Level:
HIGH
Description:
Everything
Exit code:
0
Version:
1.4.1.1026
Modules
Images
c:\users\admin\appdata\local\temp\nsxc8b3.tmp\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7788"C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0C:\Program Files (x86)\Everything\Everything.exe
Everything.exe
User:
admin
Company:
voidtools
Integrity Level:
HIGH
Description:
Everything
Exit code:
0
Version:
1.4.1.1026
Modules
Images
c:\program files (x86)\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7816"C:\Program Files (x86)\Everything\Everything.exe" -svcC:\Program Files (x86)\Everything\Everything.exe—services.exe
User:
SYSTEM
Company:
voidtools
Integrity Level:
SYSTEM
Description:
Everything
Version:
1.4.1.1026
Modules
Images
c:\program files (x86)\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
7848"C:\Program Files (x86)\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033C:\Program Files (x86)\Everything\Everything.exe—Everything-1.4.1.1026.x86-Setup.exe
User:
admin
Company:
voidtools
Integrity Level:
MEDIUM
Description:
Everything
Exit code:
0
Version:
1.4.1.1026
Modules
Images
c:\program files (x86)\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7928"C:\Program Files (x86)\Everything\Everything.exe"C:\Program Files (x86)\Everything\Everything.exe—Everything-1.4.1.1026.x86-Setup.exe
User:
admin
Company:
voidtools
Integrity Level:
MEDIUM
Description:
Everything
Version:
1.4.1.1026
Modules
Images
c:\program files (x86)\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
2 437
Read events
2 402
Write events
32
Delete events
3

Modification events

(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:DisplayName
Value:
Everything 1.4.1.1026 (x86)
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\Everything\Uninstall.exe
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:NoModify
Value:
1
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:NoRepair
Value:
1
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:Publisher
Value:
voidtools
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:EstimatedSize
Value:
3072
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Everything\Everything.exe
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:DisplayVersion
Value:
1.4.1.1026
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Everything
(PID) Process:(7740) Everything.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\voidtools\Everything
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Everything
Executable files
10
Suspicious files
5
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\InstallOptions.initext
MD5:F4B7EA54A35FE41EB4ABB5F9E53CD9DD
SHA256:B520532CE65105E5414423491084A05EEC67ADD6CA5FEF67B56BB9866C07BB95
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\InstallOptions2.initext
MD5:2D388F85F070760E18EC39C0DF0980DB
SHA256:6003368F4183B166539C96B734C01595A9D1B1494C11F16AEDEFE8AD68E9CFA8
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\InstallOptions.dllexecutable
MD5:ECE25721125D55AA26CDFE019C871476
SHA256:C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\License.txttext
MD5:3CA499E57472869658D7E877E1EF7ABA
SHA256:4F066C930DB22DA8BF0A940F4F9ECD43A208B4697288ADEA26AB5EB7DAEAAA81
7740Everything.exeC:\Program Files (x86)\Everything\Everything.lngbinary
MD5:112F64226EE5A339BBE7AEFBD9E8DEBA
SHA256:D925B044BAA9AF9375B8918758A4CCF12B48C5DC7B4AABA8791B92E77E9233F1
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\Uninstall.exeexecutable
MD5:4C5F28025A2603F28F5DC07EB8B802A9
SHA256:1316A694538AD8C2333836CE0AB3A748B670CBAB394B4683A59219772F1F92EE
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\Everything\Everything.exeexecutable
MD5:C665FA0AA5AFA3FB41C21AFE5884B4F1
SHA256:FB653FD840B0399CEA31986B49B5CEADD28FB739DD2403A8BB05051EEA5E5BBC
6824Everything-1.4.1.1026.x86-Setup.exeC:\Users\admin\AppData\Local\Temp\nsxC8B3.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
7740Everything.exeC:\Program Files (x86)\Everything\License.txttext
MD5:3CA499E57472869658D7E877E1EF7ABA
SHA256:4F066C930DB22DA8BF0A940F4F9ECD43A208B4697288ADEA26AB5EB7DAEAAA81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.23:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.23:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
8032
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.23
  • 23.216.77.18
  • 23.216.77.25
  • 23.216.77.21
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.130
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Everything-1.4.1.1026.x86-Setup.exe