File name:

Modrinth App_0.9.3_x64-setup.exe

Full analysis: https://app.any.run/tasks/b1591162-acef-4b09-ab52-0b3353a8feaa
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 12:12:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

559CE1AC3BA3CE739F45F8837060EF2E

SHA1:

E76C970DBD1D554D38CD4B99F61E7830B101B1EC

SHA256:

D792E05E4F4BE36E8A0DF87BC9EF64C44A3DF23FD04AC72EEC8DA5024988CFBC

SSDEEP:

98304:sJ8J2Aqa4QzaSQwK6JakBsRjknZJxAc+Y/IUO8iCDWQNuvj7AfqEtSa3a64uE0jX:sWnFWb0q1L0OW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)

    • Searches for installed software

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)

    • The process creates files with name similar to system file names

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)

    • Process drops legitimate windows executable

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Executable content was dropped or overwritten

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4608)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Process requests binary or script from the Internet

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)

    • There is functionality for taking screenshot (YARA)

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 3100)

  • INFO

    • The sample compiled with english language support

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Checks supported languages

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4608)
      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Reads the computer name

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)
      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Create files in a temporary directory

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)

    • Checks proxy server information

      • Modrinth App_0.9.3_x64-setup.exe (PID: 4560)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • wermgr.exe (PID: 6644)

    • Creates files in the program directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 4608)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Reads the software policy settings

      • wermgr.exe (PID: 6644)
      • MicrosoftEdgeUpdate.exe (PID: 3100)

    • Creates files or folders in the user directory

      • wermgr.exe (PID: 6644)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.9.3.0
ProductVersionNumber: 0.9.3.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Modrinth App
FileVersion: 0.9.3
LegalCopyright: -
ProductName: Modrinth App
ProductVersion: 0.9.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start modrinth app_0.9.3_x64-setup.exe sppextcomobj.exe no specs slui.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe modrinth app_0.9.3_x64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2516"C:\Users\admin\AppData\Local\Temp\Modrinth App_0.9.3_x64-setup.exe" C:\Users\admin\AppData\Local\Temp\Modrinth App_0.9.3_x64-setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Modrinth App
Exit code:
3221226540
Version:
0.9.3
Modules
Images
c:\users\admin\appdata\local\temp\modrinth app_0.9.3_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3100"C:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.49
Modules
Images
c:\program files (x86)\microsoft\temp\eud9b8.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4112C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4560"C:\Users\admin\AppData\Local\Temp\Modrinth App_0.9.3_x64-setup.exe" C:\Users\admin\AppData\Local\Temp\Modrinth App_0.9.3_x64-setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Modrinth App
Version:
0.9.3
Modules
Images
c:\users\admin\appdata\local\temp\modrinth app_0.9.3_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4608C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Modrinth App_0.9.3_x64-setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.49
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5960"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6644"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "3100" "2064" "1804" "2068" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 395
Read events
4 361
Write events
32
Delete events
2

Modification events

(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3E53739A-1201-4F68-8C67-80F178EBF789}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.49" shell_version="1.3.147.37" ismachine="1" sessionid="{7BD2A20F-3F9E-45D2-BD82-9E3AAA7F2D67}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{3E53739A-1201-4F68-8C67-80F178EBF789}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.49" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="9742299742" install_time_ms="344"/></app></request>
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3E53739A-1201-4F68-8C67-80F178EBF789}
Operation:writeName:PersistedPingTime
Value:
133900567371017964
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3E53739A-1201-4F68-8C67-80F178EBF789}
Operation:delete keyName:(default)
Value:
(PID) Process:(6644) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
237C0B6800000000
(PID) Process:(6644) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
10E8100000000000
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{bd5fd92f-f0c2-8534-0aac-76bf7c29d13c}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{bd5fd92f-f0c2-8534-0aac-76bf7c29d13c}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(3100) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings
Operation:writeName:setup_lock_acquire_ms
Value:
0300000000000000000000000000000000000000000000000000000000000000
Executable files
204
Suspicious files
8
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
4560Modrinth App_0.9.3_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nscBC20.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
4560Modrinth App_0.9.3_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nscBC20.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:3183363DEE370C1ADB75B36D381C37DB
SHA256:228BB625B37700C215E3B23C7E7DEEDE8931B32646CEBB80E3CFBFE9BE945EDB
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\msedgeupdate.dllexecutable
MD5:34366289614548C60837E31DA6477A6E
SHA256:6EE3E95AA78DBD5B3F469F670072574AFA16EA00EE2A7077472BF0405F572635
4560Modrinth App_0.9.3_x64-setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:FA04ED70DC9743693C0B62776547BBF4
SHA256:0A7FF586F6F5A830729949F301A444E4C565898463EBA1C7E907B3FE6EFC5267
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:BBD650A482ED31B5FD9B1C1636A08EA1
SHA256:C78F97F6E2DB213366AFB7EF57720CC0801CAFB428C436E8C8A780AB74F4C1E2
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\psmachine.dllexecutable
MD5:F10322ED75B0567C0A69DBF1163F9503
SHA256:9DB888B286DC32656B936D5E1438D39D46DA82212826F36C29DD99FCB0419803
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\EdgeUpdate.datbinary
MD5:369BBC37CFF290ADB8963DC5E518B9B8
SHA256:3D7EC761BEF1B1AF418B909F1C81CE577C769722957713FDAFBC8131B0A0C7D3
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\psmachine_64.dllexecutable
MD5:1F2C831EEA682084A8D08408A9A004C4
SHA256:70991CB93309773CED85BE9FF4D687957A207FBD04F695A13273704DED1FB15B
4608MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUD9B8.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:B2CA6C419F03D1AF9B283E8E696504DC
SHA256:1AD04F1EF3A5C1DC31EFE1F08FAF6ABD35C0721E10D11DE31823DDBF5882E0D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
868 b
whitelisted
4560
Modrinth App_0.9.3_x64-setup.exe
GET
301
23.218.210.69:80
http://go.microsoft.com/fwlink/p/?LinkId=2124703
DE
—
—
whitelisted
5548
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
6644
wermgr.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
868 b
whitelisted
6644
wermgr.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
5548
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
4560
Modrinth App_0.9.3_x64-setup.exe
GET
200
184.24.77.33:80
http://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/52b8103e-36c0-4201-990f-35a73867132f/MicrosoftEdgeWebview2Setup.exe
DE
executable
1.58 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4560
Modrinth App_0.9.3_x64-setup.exe
23.218.210.69:80
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4560
Modrinth App_0.9.3_x64-setup.exe
184.24.77.33:80
msedge.sf.dl.delivery.mp.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.129
  • 40.126.31.130
  • 40.126.31.1
  • 20.190.159.128
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 184.24.77.33
  • 184.24.77.30
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

PID
Process
Class
Message
4560
Modrinth App_0.9.3_x64-setup.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Modrinth App_0.9.3_x64-setup.exe