File name:

ep_setup.exe

Full analysis: https://app.any.run/tasks/16f3940f-d958-4242-a8cd-508900d9ddd5
Verdict: Malicious activity
Analysis date: September 14, 2024, 14:02:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

45A5A443C01ABD7618EFEF4827241312

SHA1:

5390D36A371F0598B86301961D5FDB329E368E7A

SHA256:

D7F98B8AF8A3BFE9D93CE31558A62E4D5D0CD425BC30BBC0D517901E5B82BF46

SSDEEP:

98304:d3wG5ry+gH0n/unRs7ZUckHt62FqWDs5dHe0nFJK9geep/c5S69gpoRWkfmEoxel:J7JNqLgB6mCt2Ki

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • ep_setup.exe (PID: 7040)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ep_setup.exe (PID: 5072)
      • ep_setup.exe (PID: 7040)
      • StartMenuExperienceHost.exe (PID: 3908)
      • SearchApp.exe (PID: 5792)

    • Reads security settings of Internet Explorer

      • ep_setup.exe (PID: 7040)
      • ep_setup.exe (PID: 5072)
      • StartMenuExperienceHost.exe (PID: 3908)

    • Application launched itself

      • ep_setup.exe (PID: 5072)

    • Uses TASKKILL.EXE to kill process

      • ep_setup.exe (PID: 7040)

    • Starts SC.EXE for service management

      • ep_setup.exe (PID: 7040)

    • Executable content was dropped or overwritten

      • ep_setup.exe (PID: 7040)

    • The process creates files with name similar to system file names

      • ep_setup.exe (PID: 7040)

    • Creates a software uninstall entry

      • ep_setup.exe (PID: 7040)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6148)
      • regsvr32.exe (PID: 1432)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 872)

  • INFO

    • Checks supported languages

      • ep_setup.exe (PID: 5072)
      • ep_setup.exe (PID: 7040)
      • SearchApp.exe (PID: 5792)
      • StartMenuExperienceHost.exe (PID: 3908)
      • TextInputHost.exe (PID: 6368)

    • Reads the computer name

      • ep_setup.exe (PID: 5072)
      • ep_setup.exe (PID: 7040)
      • StartMenuExperienceHost.exe (PID: 3908)
      • TextInputHost.exe (PID: 6368)
      • SearchApp.exe (PID: 5792)

    • The process uses the downloaded file

      • ep_setup.exe (PID: 5072)
      • ep_setup.exe (PID: 7040)

    • Process checks computer location settings

      • ep_setup.exe (PID: 5072)
      • ep_setup.exe (PID: 7040)
      • StartMenuExperienceHost.exe (PID: 3908)
      • SearchApp.exe (PID: 5792)

    • Creates files in the program directory

      • ep_setup.exe (PID: 7040)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 872)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5792)

    • Sends debugging messages

      • StartMenuExperienceHost.exe (PID: 3908)

    • Checks proxy server information

      • explorer.exe (PID: 872)
      • SearchApp.exe (PID: 5792)
      • slui.exe (PID: 2816)

    • Reads the software policy settings

      • explorer.exe (PID: 872)
      • SearchApp.exe (PID: 5792)
      • slui.exe (PID: 6176)
      • slui.exe (PID: 2816)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 872)

    • Reads Environment values

      • SearchApp.exe (PID: 5792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:09:12 12:16:43+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 151552
InitializedDataSize: 10378240
UninitializedDataSize: -
EntryPoint: 0x8bd8
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 22621.3880.66.6
ProductVersionNumber: 22621.3880.66.6
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ExplorerPatcher Developers
FileDescription: ExplorerPatcher Setup Program
FileVersion: 22621.3880.66.6
InternalName: ep_setup.exe
LegalCopyright: (C) 2021-2024 ExplorerPatcher Developers. All rights reserved.
OriginalFileName: ep_setup.exe
ProductName: ExplorerPatcher
ProductVersion: 22621.3880.66.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
19
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ep_setup.exe no specs ep_setup.exe taskkill.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe mobsync.exe no specs sppextcomobj.exe no specs slui.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
872"C:\WINDOWS\explorer.exe" /NoUACCheckC:\Windows\explorer.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
1432"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"C:\Windows\System32\regsvr32.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2816C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3908"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
5072"C:\Users\admin\Desktop\ep_setup.exe" C:\Users\admin\Desktop\ep_setup.exe—explorer.exe
User:
admin
Company:
ExplorerPatcher Developers
Integrity Level:
MEDIUM
Description:
ExplorerPatcher Setup Program
Exit code:
0
Version:
22621.3880.66.6
Modules
Images
c:\users\admin\desktop\ep_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5124C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5160\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5492"C:\WINDOWS\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EBC:\Windows\System32\sc.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5544"C:\WINDOWS\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EBC:\Windows\System32\sc.exe—ep_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
29 683
Read events
29 322
Write events
329
Delete events
32

Modification events

(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:UninstallString
Value:
"C:\Program Files\ExplorerPatcher\ep_setup.exe" /uninstall
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayName
Value:
ExplorerPatcher
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:Publisher
Value:
VALINET Solutions SRL
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:NoModify
Value:
1
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:NoRepair
Value:
1
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayVersion
Value:
22621.3880.66.6
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:VersionMajor
Value:
66
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:VersionMinor
Value:
6
(PID) Process:(7040) ep_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher
Operation:writeName:DisplayIcon
Value:
C:\WINDOWS\explorer.exe
(PID) Process:(6148) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}
Operation:writeName:AppID
Value:
{A6EA9C2D-4982-4827-9204-0AC532959F6D}
Executable files
12
Suspicious files
63
Text files
301
Unknown types
2

Dropped files

PID
Process
Filename
Type
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dllexecutable
MD5:57999FF1631929462DE24BA18F61AE1C
SHA256:B21C0ED7224784B642647A8EFAD45C634BF88646638823215818B25143FEE86E
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dllexecutable
MD5:5D1F22A4A8CB76C337FEC809463092E1
SHA256:6AFD7333E956C125C9D4D3E6F88C2ED27CC41E0AA9A4E0656BA17B87C655A306
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ep_setup.exeexecutable
MD5:45A5A443C01ABD7618EFEF4827241312
SHA256:D7F98B8AF8A3BFE9D93CE31558A62E4D5D0CD425BC30BBC0D517901E5B82BF46
7040ep_setup.exeC:\Program Files\ExplorerPatcher\WebView2Loader.dllexecutable
MD5:C5F0C46E91F354C58ECEC864614157D7
SHA256:465A7DDFB3A0DA4C3965DAF2AD6AC7548513F42329B58AEBC337311C10EA0A6F
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ep_weather_host_stub.dllexecutable
MD5:AB6AA536FCAE0D915FC6856F66FF693C
SHA256:0578867D07DF70F0080E5EB864F77C7356745347B1D9CDDD568F68E10FA8AA50
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ep_gui.dllexecutable
MD5:C83153FFC63411AAF525CAA6C50C1FFC
SHA256:422D9784435C893B810DC8D02B8EAA713A030ECDDE0C29AE5A588C889CE6A7DF
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ep_weather_host.dllexecutable
MD5:F2920695EA15CC80E479D79F536437F1
SHA256:350535396C011ED00753F6CD2D30FA1D38FD0F48077B1F9D461CB3DF1B1CF39D
5792SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\65\4bnLx4S3ZRMpYV30k3R5vRy8JVg[1].jstext
MD5:97540BC45CFB7C7C4D859A7E1CE839BA
SHA256:4AE944B4A382D05A8A5B657105ADD88DD8B8F59D6309567E179CA64DF19F6075
7040ep_setup.exeC:\Windows\dxgi.dllexecutable
MD5:A3F150CEC06C4434460EF680417AF1AC
SHA256:F0D8FA3DB3127ABCDED89ABBF13F8D3C0071169618A0340570AA9B389034F176
7040ep_setup.exeC:\Program Files\ExplorerPatcher\ep_dwm.exeexecutable
MD5:85FFBD19F247F682DF7CB348429BF563
SHA256:770379D1A2DFF974D3A0D1D282B2BFD69E1C25CC2BB161C4DFB9B208330FBCB3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
61
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5792
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6612
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
872
explorer.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
872
explorer.exe
GET
302
204.79.197.219:80
http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/3F0945AE4BC25ECE16353588B05D30B61/twinui.pcshell.pdb
unknown
—
—
whitelisted
872
explorer.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
872
explorer.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
whitelisted
872
explorer.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
872
explorer.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6908
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
872
explorer.exe
GET
302
204.79.197.219:80
http://msdl.microsoft.com/download/symbols/StartUI.pdb/0B81EEDEEB6FF49A7EC7F23C15C216771/StartUI.pdb
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6612
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6776
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6612
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6612
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5792
SearchApp.exe
2.23.209.187:443
r.bing.com
Akamai International B.V.
GB
whitelisted
5792
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5792
SearchApp.exe
92.123.104.9:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
r.bing.com
  • 2.23.209.187
  • 2.23.209.183
  • 2.23.209.189
  • 2.23.209.177
  • 2.23.209.179
  • 2.23.209.154
  • 2.23.209.130
  • 2.23.209.160
  • 2.23.209.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.bing.com
  • 92.123.104.9
  • 92.123.104.12
  • 92.123.104.8
  • 92.123.104.10
  • 92.123.104.13
  • 92.123.104.16
  • 92.123.104.6
  • 92.123.104.14
  • 92.123.104.11
whitelisted
github.com
  • 140.82.121.3
shared
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ep_setup.exe