File name:

Setup--2520--Passcode.zip

Full analysis: https://app.any.run/tasks/f024ac78-60a7-4ff5-96b1-a6742bc6426f
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 13:28:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

B9E7A2C6441DB12A09312DDC1E01CA42

SHA1:

872AEA57EAAA3CCF1DA2F81F1C8AAB4982005F41

SHA256:

E1EC823B064A2F3D2A3C3D9C2A3E8BCEDF46498FDAEF32F3305B319101F16315

SSDEEP:

98304:g/xYiARl20fJitIJ5Qe0G2wQ9xjgeRCidMNvqMnmimffbbAWLm6CYH5Vf/efbuDB:Bow0NJzJysNF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)
      • hjksfs.exe (PID: 5332)
      • DistriCompiler89.exe (PID: 6540)
      • DistriCompiler89.exe (PID: 4008)
      • DistriCompiler89.exe (PID: 7384)
      • hjksfn.exe (PID: 3268)
      • DistriCompiler89.exe (PID: 5176)
      • DistriCompiler89.exe (PID: 6184)
      • VirtuServer128.exe (PID: 7524)
      • DistriCompiler89.exe (PID: 4464)

    • Actions looks like stealing of personal data

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)
      • VirtuServer128.exe (PID: 7524)

    • Steals credentials from Web Browsers

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7444)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5072)
      • FullSetup.exe (PID: 7896)
      • hjksfs.exe (PID: 5332)
      • FullSetup.exe (PID: 7944)
      • hjksfn.exe (PID: 3268)
      • VirtuServer128.exe (PID: 7524)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • Potential Corporate Privacy Violation

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)

    • Executable content was dropped or overwritten

      • hjksfs.exe (PID: 5332)
      • FullSetup.exe (PID: 7896)
      • DistriCompiler89.exe (PID: 6540)
      • DistriCompiler89.exe (PID: 4008)
      • FullSetup.exe (PID: 7944)
      • hjksfn.exe (PID: 3268)
      • DistriCompiler89.exe (PID: 7384)
      • VirtuServer128.exe (PID: 7524)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4728)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 6540)
      • DistriCompiler89.exe (PID: 5176)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 4008)

    • Process drops legitimate windows executable

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)
      • VirtuServer128.exe (PID: 7524)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4728)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • The process drops C-runtime libraries

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 7384)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 7524)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 7524)

    • Starts process via Powershell

      • powershell.exe (PID: 7308)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 7892)

  • INFO

    • Checks supported languages

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)
      • elevation_service.exe (PID: 8088)
      • hjksfs.exe (PID: 5332)
      • DistriCompiler89.exe (PID: 6540)
      • DistriCompiler89.exe (PID: 4008)
      • elevation_service.exe (PID: 5640)
      • 7za.exe (PID: 6872)
      • DistriCompiler89.exe (PID: 7384)
      • hjksfn.exe (PID: 3268)
      • DistriCompiler89.exe (PID: 5176)
      • DistriCompiler89.exe (PID: 6184)
      • 7za.exe (PID: 7488)
      • VirtuServer128.exe (PID: 7524)
      • DistriCompiler89.exe (PID: 4464)
      • 7za.exe (PID: 2040)
      • MicrosoftEdgeUpdate.exe (PID: 7892)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4728)

    • Reads the software policy settings

      • slui.exe (PID: 7244)
      • VirtuServer128.exe (PID: 7524)
      • slui.exe (PID: 8008)
      • MicrosoftEdgeUpdate.exe (PID: 7892)
      • wermgr.exe (PID: 7804)

    • Reads the machine GUID from the registry

      • FullSetup.exe (PID: 7896)
      • FullSetup.exe (PID: 7944)
      • 7za.exe (PID: 6872)
      • 7za.exe (PID: 7488)
      • VirtuServer128.exe (PID: 7524)

    • Executes as Windows Service

      • elevation_service.exe (PID: 8088)
      • elevation_service.exe (PID: 5640)

    • Reads the computer name

      • elevation_service.exe (PID: 8088)
      • FullSetup.exe (PID: 7896)
      • hjksfs.exe (PID: 5332)
      • DistriCompiler89.exe (PID: 6540)
      • DistriCompiler89.exe (PID: 4008)
      • FullSetup.exe (PID: 7944)
      • elevation_service.exe (PID: 5640)
      • 7za.exe (PID: 6872)
      • DistriCompiler89.exe (PID: 7384)
      • hjksfn.exe (PID: 3268)
      • DistriCompiler89.exe (PID: 5176)
      • DistriCompiler89.exe (PID: 6184)
      • 7za.exe (PID: 7488)
      • VirtuServer128.exe (PID: 7524)
      • 7za.exe (PID: 2040)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • Process checks computer location settings

      • FullSetup.exe (PID: 7896)
      • hjksfs.exe (PID: 5332)
      • FullSetup.exe (PID: 7944)
      • hjksfn.exe (PID: 3268)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • The sample compiled with english language support

      • FullSetup.exe (PID: 7896)
      • DistriCompiler89.exe (PID: 4008)
      • FullSetup.exe (PID: 7944)
      • DistriCompiler89.exe (PID: 7384)
      • VirtuServer128.exe (PID: 7524)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4728)
      • MicrosoftEdgeUpdate.exe (PID: 7892)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 6540)
      • DistriCompiler89.exe (PID: 4008)
      • DistriCompiler89.exe (PID: 7384)
      • VirtuServer128.exe (PID: 7524)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4728)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 4008)
      • DistriCompiler89.exe (PID: 7384)
      • DistriCompiler89.exe (PID: 6184)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 6872)
      • 7za.exe (PID: 7488)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7444)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 7524)
      • slui.exe (PID: 8008)
      • MicrosoftEdgeUpdate.exe (PID: 7892)
      • wermgr.exe (PID: 7804)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 7524)
      • wermgr.exe (PID: 7804)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:16 14:58:50
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Setup_F@lder/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
45
Malicious processes
14
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe fullsetup.exe fullsetup.exe slui.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs hjksfs.exe districompiler89.exe districompiler89.exe 7za.exe no specs chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs CMSTPLUA districompiler89.exe hjksfn.exe districompiler89.exe no specs districompiler89.exe no specs 7za.exe no specs virtuserver128.exe conhost.exe no specs districompiler89.exe no specs 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1804"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—FullSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exe—DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—FullSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3240"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—FullSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3268"C:\Users\admin\hjksfn.exe" C:\Users\admin\hjksfn.exe
FullSetup.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.4.0.1795
Modules
Images
c:\users\admin\hjksfn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4008C:\ProgramData\Iaclientv2\DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exe
DistriCompiler89.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4464"C:\ProgramData\Iaclientv2\DistriCompiler89.exe" C:\ProgramData\Iaclientv2\DistriCompiler89.exe—dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
4728"C:\ProgramData\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\ProgramData\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\programdata\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5072"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Setup--2520--Passcode.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
14 457
Read events
14 370
Write events
85
Delete events
2

Modification events

(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Setup--2520--Passcode.zip
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
217
Suspicious files
29
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5072.42083\Setup_F@lder\FullSetup.exe —
MD5:—
SHA256:—
5072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5072.43909\Setup_F@lder\FullSetup.exe —
MD5:—
SHA256:—
8124chrome.exeC:\Users\admin\AppData\Local\Temp\Login Databinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7896FullSetup.exeC:\Users\admin\hjksfs.exeexecutable
MD5:06CD992D7E3A5334AD400EAA61C160AB
SHA256:F86FB2936D6B0B2E6C84519734016EE8AE695457734194C6331F86D1962091DD
5332hjksfs.exeC:\Users\admin\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
8172chrome.exeC:\Users\admin\AppData\Local\Temp\Cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
6540DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
5332hjksfs.exeC:\Users\admin\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
5332hjksfs.exeC:\Users\admin\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
6540DistriCompiler89.exeC:\ProgramData\Iaclientv2\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
66
DNS requests
27
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7896
FullSetup.exe
GET
200
104.21.45.251:80
http://h4.tattlererun.life/shark.bin
unknown
—
—
unknown
7944
FullSetup.exe
GET
—
104.21.45.251:80
http://h4.tattlererun.life/sh.ext.bin
unknown
—
—
unknown
7524
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
7944
FullSetup.exe
GET
200
104.21.45.251:80
http://h4.tattlererun.life/shark.bin
unknown
—
—
unknown
7804
wermgr.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7524
VirtuServer128.exe
GET
200
3.165.215.26:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
7804
wermgr.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.64
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.2
  • 20.190.160.3
  • 20.190.160.131
  • 20.190.160.65
  • 20.190.160.66
  • 40.126.32.74
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7896
FullSetup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7896
FullSetup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7944
FullSetup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7944
FullSetup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
7524
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup--2520--Passcode.zip