File name:

Setup.exe

Full analysis: https://app.any.run/tasks/9fb4563b-da31-4c39-8b6c-b2a0e0beb9ba
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 11:36:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

18343F5CBF09AF16B70E4BDB87C5FC91

SHA1:

658DAA31317EE322B731BBEB60513CF7B4BDEB0B

SHA256:

DB3FC10F5DD5F1D577A19988E1C4E127935224CFAE35C02823F312C88CA953D8

SSDEEP:

98304:cPFKLwTEGKLaCJl7UotN5srrUK7vgyONaCr:N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)
      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)
      • WB3CLQX67JBJ0EUM1.exe (PID: 5720)
      • A0I9AJ2OCUELTUP4XXW327.exe (PID: 6156)
      • 1T9VRPYAY297LOAAL3I8F3H9KUEN1HT.exe (PID: 4488)

    • LUMMA mutex has been found

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)

    • Steals credentials from Web Browsers

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)

    • Changes the autorun value in the registry

      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)

    • Known privilege escalation attack

      • dllhost.exe (PID: 4996)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 4776)
      • Clus-Blue.exe (PID: 1040)
      • Clus-Blue.exe (PID: 3008)
      • Setup.exe (PID: 6744)
      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)

    • Process drops legitimate windows executable

      • Setup.exe (PID: 4776)
      • Clus-Blue.exe (PID: 1040)
      • Setup.exe (PID: 6744)

    • The process drops C-runtime libraries

      • Setup.exe (PID: 4776)
      • Clus-Blue.exe (PID: 1040)
      • Setup.exe (PID: 6744)

    • Starts itself from another location

      • Clus-Blue.exe (PID: 1040)
      • Clus-Blue.exe (PID: 2244)

    • Searches for installed software

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)

    • Executes application which crashes

      • WB3CLQX67JBJ0EUM1.exe (PID: 5720)

  • INFO

    • The sample compiled with russian language support

      • Setup.exe (PID: 4776)

    • Manual execution by a user

      • Setup.exe (PID: 6744)

    • Checks supported languages

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)
      • Clus-Blue.exe (PID: 1040)
      • Clus-Blue.exe (PID: 3008)
      • WB3CLQX67JBJ0EUM1.exe (PID: 5720)
      • 360Tray.exe (PID: 6712)
      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)
      • Clus-Blue.exe (PID: 2244)
      • A0I9AJ2OCUELTUP4XXW327.exe (PID: 6156)
      • Clus-Blue.exe (PID: 6512)
      • 1T9VRPYAY297LOAAL3I8F3H9KUEN1HT.exe (PID: 4488)
      • 360Tray.exe (PID: 4040)
      • Clus-Blue.exe (PID: 6392)
      • Clus-Blue.exe (PID: 6148)

    • Reads the computer name

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)
      • Clus-Blue.exe (PID: 1040)
      • Clus-Blue.exe (PID: 3008)
      • Clus-Blue.exe (PID: 2244)
      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)
      • 360Tray.exe (PID: 6712)
      • Clus-Blue.exe (PID: 6512)
      • 360Tray.exe (PID: 4040)
      • Clus-Blue.exe (PID: 6392)
      • Clus-Blue.exe (PID: 6148)

    • Reads the software policy settings

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)

    • The sample compiled with english language support

      • Setup.exe (PID: 4776)
      • Clus-Blue.exe (PID: 1040)
      • Setup.exe (PID: 6744)
      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)

    • Creates files in the program directory

      • Clus-Blue.exe (PID: 1040)
      • Clus-Blue.exe (PID: 3008)
      • JB0EEJU1TROISKQGDPSCHWFG83R3.exe (PID: 5228)

    • The sample compiled with chinese language support

      • Clus-Blue.exe (PID: 3008)

    • Create files in a temporary directory

      • Setup.exe (PID: 4776)
      • Setup.exe (PID: 6744)
      • Clus-Blue.exe (PID: 3008)
      • Clus-Blue.exe (PID: 6392)
      • Clus-Blue.exe (PID: 6512)
      • Clus-Blue.exe (PID: 6148)

    • Reads the machine GUID from the registry

      • 360Tray.exe (PID: 6712)
      • 360Tray.exe (PID: 4040)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 4996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:06:27 10:41:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 910848
InitializedDataSize: 919552
UninitializedDataSize: -
EntryPoint: 0x8415f
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 3.2.30.4914
ProductVersionNumber: 3.2.30.4914
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Unicode
CompanyName: Яндекс
FileDescription: YandexDiskSetup
FileVersion: 3.2.30.4914
InternalName: YandexDiskSetup
LegalCopyright: © 2016-2023 ООО "ЯНДЕКС"
OriginalFileName: YandexDiskSetup.exe
ProductName: Яндекс.Диск
ProductVersion: 3.2.30.4914
Tag040904B0: -
Tag041F04B0: -
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
20
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start #LUMMA setup.exe sppextcomobj.exe no specs slui.exe no specs #LUMMA setup.exe clus-blue.exe clus-blue.exe wb3clqx67jbj0eum1.exe jb0eeju1troiskqgdpschwfg83r3.exe 360tray.exe no specs clus-blue.exe no specs clus-blue.exe no specs a0i9aj2ocueltup4xxw327.exe no specs 1t9vrpyay297loaal3i8f3h9kuen1ht.exe no specs 360tray.exe no specs CMSTPLUA clus-blue.exe no specs clus-blue.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1040"C:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\Clus-Blue.exe"C:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\Clus-Blue.exe
Setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\o3qtkmze4eovt9rnvcbduhdjxa\clus-blue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1040C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5720 -s 640C:\Windows\SysWOW64\WerFault.exe—WB3CLQX67JBJ0EUM1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2244"C:\Users\admin\AppData\Local\Temp\84P40ADNQX6MLJBVE0\Clus-Blue.exe"C:\Users\admin\AppData\Local\Temp\84P40ADNQX6MLJBVE0\Clus-Blue.exe—Setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\84p40adnqx6mljbve0\clus-blue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2392C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5720 -s 596C:\Windows\SysWOW64\WerFault.exe—WB3CLQX67JBJ0EUM1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3008C:\ProgramData\Fidl\Clus-Blue.exeC:\ProgramData\Fidl\Clus-Blue.exe
Clus-Blue.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\fidl\clus-blue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4040"C:\ProgramData\Fidl\360Tray.exe" "C:\ProgramData\Fidl\360Tray.exe" /onuiC:\ProgramData\Fidl\360Tray.exe—Clus-Blue.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全卫士 安全防护中心模块
Exit code:
0
Version:
12, 0, 0, 1761
Modules
Images
c:\windows\syswow64\input.dll
c:\programdata\fidl\360tray.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
4488"C:\Users\admin\AppData\Local\Temp\1T9VRPYAY297LOAAL3I8F3H9KUEN1HT.exe"C:\Users\admin\AppData\Local\Temp\1T9VRPYAY297LOAAL3I8F3H9KUEN1HT.exe—Setup.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Exit code:
0
Version:
14.09
Modules
Images
c:\users\admin\appdata\local\temp\1t9vrpyay297loaal3i8f3h9kuen1ht.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4776"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
explorer.exe
User:
admin
Company:
Яндекс
Integrity Level:
MEDIUM
Description:
YandexDiskSetup
Exit code:
0
Version:
3.2.30.4914
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4996C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
5228"C:\Users\admin\AppData\Local\Temp\JB0EEJU1TROISKQGDPSCHWFG83R3.exe"C:\Users\admin\AppData\Local\Temp\JB0EEJU1TROISKQGDPSCHWFG83R3.exe
Setup.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Version:
14.09
Modules
Images
c:\users\admin\appdata\local\temp\jb0eeju1troiskqgdpschwfg83r3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 779
Read events
2 774
Write events
5
Delete events
0

Modification events

(PID) Process:(5228) JB0EEJU1TROISKQGDPSCHWFG83R3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Sysinternals\Autoruns
Operation:writeName:EulaAccepted
Value:
1
(PID) Process:(4488) 1T9VRPYAY297LOAAL3I8F3H9KUEN1HT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Sysinternals\Autoruns
Operation:writeName:EulaAccepted
Value:
1
(PID) Process:(5228) JB0EEJU1TROISKQGDPSCHWFG83R3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Safari
Value:
C:\ProgramData\Safari\Safari.exe
(PID) Process:(4996) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
45
Suspicious files
12
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4776Setup.exeC:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\Qt5Network.dllexecutable
MD5:D73AA4F8749269D1590541E567387489
SHA256:7BFDFED166846921DAB87D51CA9B338C1FDD7F96C117E3BA0EDC07ED06DD9CB1
4776Setup.exeC:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\Qt5Core.dllexecutable
MD5:5AF1A8D3E720C2ECD7C835510429DA9F
SHA256:45A830C44F93ABA5658E5E9697DE42B3F3EB383BBBF174ADE65A78F9A6C7D8B2
1040Clus-Blue.exeC:\ProgramData\Fidl\libcrypto-1_1-x64.dllexecutable
MD5:CF1DF078FA02C3F20A613FF9FACEEE46
SHA256:0897F6EF6C7875F64ED82AD83473FD8EA119CFEAA959B0AB2B2F981C1DA7C679
1040Clus-Blue.exeC:\ProgramData\Fidl\libcurl.dllexecutable
MD5:1824EC8765523B8BBC77B14F665F842A
SHA256:FBADEDE08DFCBC8871C1BD2027A73F3AAC74B3A8247240ED315CCCABC3363F20
4776Setup.exeC:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\msvcp120.dllexecutable
MD5:EDEF53778EAAFE476EE523BE5C2AB67F
SHA256:92FAEDD18A29E1BD2DD27A1D805EA5AA3E73B954A625AF45A74F49D49506D20F
4776Setup.exeC:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\libssl-1_1-x64.dllexecutable
MD5:2574E9E3159CD45194EAC2591EADC73A
SHA256:2D7208FAE6767F5F01664448F4EA89C8009F75DB4C20FECDEA508A498A6A1223
4776Setup.exeC:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\libcurl.dllexecutable
MD5:1824EC8765523B8BBC77B14F665F842A
SHA256:FBADEDE08DFCBC8871C1BD2027A73F3AAC74B3A8247240ED315CCCABC3363F20
1040Clus-Blue.exeC:\ProgramData\Fidl\Framework.dllexecutable
MD5:2207332818329E3CE4E5E020BA1B1F04
SHA256:C554A0BD610BA0B10D8D92BB588FC86893B59985E4ED9316D340781C482FCAA2
1040Clus-Blue.exeC:\ProgramData\Fidl\Clus-Blue.exeexecutable
MD5:20BC61AA222AA74059F4D42872A76EB5
SHA256:B1465F5CE1D0F83EF9B6086C81D8788B50C09BD329374BD3D04DC61807551435
4776Setup.exeC:\Users\admin\AppData\Local\Temp\O3QTKMZE4EOVT9RNVCBDUHDJXA\msvcr120.dllexecutable
MD5:AEB29CCC27E16C4FD223A00189B44524
SHA256:D28C7AB34842B6149609BD4E6B566DDAB8B891F0D5062480A253EF20A6A2CAAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
35
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
780
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
780
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4776
Setup.exe
172.67.204.131:443
nodepathr.run
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.185
  • 23.48.23.140
  • 23.48.23.192
  • 23.48.23.180
  • 23.48.23.181
  • 23.48.23.190
  • 23.48.23.176
  • 23.48.23.183
  • 23.48.23.191
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.1
  • 20.190.159.128
  • 20.190.159.131
  • 20.190.159.130
  • 20.190.159.75
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nodepathr.run
  • 172.67.204.131
  • 104.21.61.7
unknown
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe