File name:

Complete_Setup_Downloaded_Here.zip

Full analysis: https://app.any.run/tasks/747c487f-05ff-4574-9d86-b5f184023769
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 16:00:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
mpress
arkei
stealer
vidar
themida
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

6998E77840646F5575DE5B2AC0632E46

SHA1:

B9DB57E91977AD0194B471BE1E2F70FDD49584AE

SHA256:

EF033B17034D3480EE0C076F699DA819C48E82558299EB6247C678E0195694FE

SSDEEP:

98304:tmyP1HL2KNEDR3hDAiYSZdcv/j0Y0Fod4UmG+Km0syB7P/CGNRSvKOHnJ2rutZpt:RLvIulHSb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ARKEI has been detected (YARA)

      • Setup.exe (PID: 8096)

    • VIDAR has been detected (YARA)

      • Setup.exe (PID: 8096)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7404)
      • Setup.exe (PID: 8096)

    • Reads the BIOS version

      • Setup.exe (PID: 8096)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Setup.exe (PID: 8096)

    • Multiple wallet extension IDs have been found

      • Setup.exe (PID: 8096)

    • Connects to the server without a host name

      • Setup.exe (PID: 8096)

  • INFO

    • Reads the computer name

      • Setup.exe (PID: 8096)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 8096)

    • Checks supported languages

      • Setup.exe (PID: 8096)

    • Manual execution by a user

      • WINWORD.EXE (PID: 8156)
      • mspaint.exe (PID: 7308)
      • WINWORD.EXE (PID: 632)
      • WINWORD.EXE (PID: 864)
      • WINWORD.EXE (PID: 7788)
      • WINWORD.EXE (PID: 2692)

    • Reads the software policy settings

      • Setup.exe (PID: 8096)
      • slui.exe (PID: 7592)

    • Checks proxy server information

      • Setup.exe (PID: 8096)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 8096)

    • Mpress packer has been detected

      • Setup.exe (PID: 8096)

    • Themida protector has been detected

      • Setup.exe (PID: 8096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:01:18 15:59:10
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: locale/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
17
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe #VIDAR setup.exe winword.exe ai.exe no specs winword.exe ai.exe no specs slui.exe winword.exe ai.exe no specs winword.exe ai.exe no specs mspaint.exe no specs winword.exe ai.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\shouldperiod.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
864"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\edgeorders.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
1096"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "965EBCAC-ECD5-4382-BC13-302D379B4AE1" "1BCE1B01-C7F1-40A3-8074-2FC3F339841B" "632"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\rpcrt4.dll
2152"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "85FDAF1A-5DFA-4542-B3DF-DCAE9C8C4761" "F27A878B-7A29-4280-8FF8-0A9F59C4286F" "8156"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2692"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\shouldperiod.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
3768"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "CCE2DF58-0B86-417A-8F41-EC9B91E61328" "24395DE8-E399-4F5B-BFE7-8619CB33C2D7" "2692"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5332"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "FA40D13C-DD8A-45E2-A1AF-2DCAE021D515" "DC43F5CD-9FAA-4AE6-A38C-375A9D749C4C" "864"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6072"C:\Users\admin\AppData\Local\Temp\Rar$EXa7404.1973\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7404.1973\Setup.exe—WinRAR.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
MEDIUM
Description:
PerfectFit Object Browse ActiveX Controls Module
Version:
19.0.0.325
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7404.1973\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7308"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\entrycart.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7404"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Complete_Setup_Downloaded_Here.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
45 642
Read events
44 876
Write events
660
Delete events
106

Modification events

(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Complete_Setup_Downloaded_Here.zip
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8096) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8096) Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
25
Suspicious files
539
Text files
30
Unknown types
8

Dropped files

PID
Process
Filename
Type
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\pgscripts-9.6.mobinary
MD5:5589DDDD04E12E684B0102B0FC953633
SHA256:E205F622E7D7CC822D90033C2F5F82A311EF543CE4F9CBCE8168C1D345B2BCB4
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\ecpglib-9.6.mobinary
MD5:0FE321ADFEC0A8B140526382E99337C1
SHA256:F6A42F0D7C12F5E341E23D4322E354F3C6FE35338932B3635E4D34AA1F030886
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\pg_ctl-9.6.mobinary
MD5:AE61C63D421102B7CB218F464FE3633D
SHA256:48E40F6896C8B72F62FAC7748127E930075A3270C2EBB72DDB7C7335BEF1DEE7
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\plpython-9.6.mobinary
MD5:14ABDD0E7BCEAEAA0E08C4FF949C0533
SHA256:04B938E14B886398676970160C0F2B6BDE6D245864D11C8B91AC7092CFFE6A57
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\pg_dump-9.6.mobinary
MD5:7AA87C68FA16150FF3411541968B46FB
SHA256:C594C9DC593A5DCFFF0721B4CF37500A931FF87CF6DED247CC55DC647BA1F3A1
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\de\pgscripts-9.6.mobinary
MD5:F988A12513100EA21D9A893639F2529B
SHA256:85BD4A8D6B2166D1436314BFAAAF53B6CE0078290E6F83DBA61ECFEB7C18B00A
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\de\ecpglib-9.6.mobinary
MD5:5B07C1ABF0ACC3442D68EC5E761321E7
SHA256:473EF20BEF0FC9DB514C2441C0E0EAE7EF0CA2C15BD8896CEC2DCCCD60FB5434
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\plpgsql-9.6.mobinary
MD5:FEFDC017F62A48DAB43B01D6B1F2DC2C
SHA256:F43C36CF0BDEF38ADBF93473F96A946CAD5B92D9A7EDCF8D7B855B6045B54B6E
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\de\initdb-9.6.mobinary
MD5:7BC21D76C6CEA8D46D1768DA4F7BDA6E
SHA256:899EDDE0D86DE39F2B624FBEEE2C01001BE374714577A74198B31B0FF30B3D3D
7404WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7404.27723\locale\cs\pltcl-9.6.mobinary
MD5:5326D235D6FB3FBAB2BA43428F06257B
SHA256:98C019B628555563767EC96499DFA16FC098D752A586D96CCC34857B1E7DEDF5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
118
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.25.102.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.25.102.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8096
Setup.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
—
—
whitelisted
8096
Setup.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
unknown
—
—
whitelisted
8096
Setup.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDytgE3K904Dg%3D%3D
unknown
—
—
whitelisted
8096
Setup.exe
GET
—
157.90.148.112:80
http://157.90.148.112/15
unknown
—
—
unknown
8096
Setup.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
unknown
—
—
whitelisted
8156
WINWORD.EXE
GET
200
184.25.102.141:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
184.25.102.141:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
2104
svchost.exe
184.25.102.141:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5496
MoUsoCoreWorker.exe
23.200.189.225:80
www.microsoft.com
Moratelindo Internet Exchange Point
ID
whitelisted
2104
svchost.exe
23.200.189.225:80
www.microsoft.com
Moratelindo Internet Exchange Point
ID
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8096
Setup.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.251.39.110
whitelisted
crl.microsoft.com
  • 184.25.102.141
whitelisted
www.microsoft.com
  • 23.200.189.225
whitelisted
t.me
  • 149.154.167.99
whitelisted
ocsp.godaddy.com
  • 192.124.249.22
whitelisted
steamcommunity.com
  • 23.207.106.113
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
omex.cdn.office.net
  • 184.25.102.75
whitelisted

Threats

PID
Process
Class
Message
8096
Setup.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
8096
Setup.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
8096
Setup.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Complete_Setup_Downloaded_Here.zip