File name:

setup.exe

Full analysis: https://app.any.run/tasks/7550c7f9-b412-48b7-a4d8-b144c2af5eac
Verdict: Malicious activity
Analysis date: May 10, 2025, 23:15:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

FD100EC6F3DD7FC22BE320A984E1AA7D

SHA1:

2DD31BF4813DC0E273FA5210C442D68876002F28

SHA256:

F16DF2BC688EE1E31CFD4040DED359006C73092FDC310FBD7A9BA4C023085CCC

SSDEEP:

98304:SShDa+jhZu8M4HmOVWjtKxgADpN25hAp42NAOQmMYS32afU9tto10wFsBRAbYpBL:4Xwa8YCp3pIwuuT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • setup.exe (PID: 4896)

    • Executing a file with an untrusted certificate

      • setup.exe (PID: 4896)
      • setup.exe (PID: 960)
      • setup.exe (PID: 1532)
      • setup.exe (PID: 6404)

    • Adds process to the Windows Defender exclusion list

      • setup.exe (PID: 6404)

    • Changes Windows Defender settings

      • setup.exe (PID: 6404)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 5744)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)

    • The process drops C-runtime libraries

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)
      • powershell.exe (PID: 6240)
      • Dism.exe (PID: 2516)
      • Dism.exe (PID: 5740)
      • Dism.exe (PID: 6872)

    • Application launched itself

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)

    • Process drops python dynamic module

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)

    • Loads Python modules

      • setup.exe (PID: 960)
      • setup.exe (PID: 6404)

    • Starts POWERSHELL.EXE for commands execution

      • setup.exe (PID: 960)
      • setup.exe (PID: 6404)

    • The process checks if current user has admin rights

      • setup.exe (PID: 960)
      • setup.exe (PID: 6404)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 5416)
      • powershell.exe (PID: 1912)

    • Starts process via Powershell

      • powershell.exe (PID: 5204)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 4008)

    • Script adds exclusion process to Windows Defender

      • setup.exe (PID: 6404)

    • Script adds exclusion path to Windows Defender

      • setup.exe (PID: 6404)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 4424)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 6240)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6240)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 6240)
      • Dism.exe (PID: 2516)
      • Dism.exe (PID: 6872)
      • Dism.exe (PID: 5740)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 4008)
      • DismHost.exe (PID: 1388)
      • DismHost.exe (PID: 6668)
      • DismHost.exe (PID: 6876)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 1532)

    • Removes files via Powershell

      • powershell.exe (PID: 3884)

  • INFO

    • Checks supported languages

      • setup.exe (PID: 4896)
      • setup.exe (PID: 960)
      • setup.exe (PID: 1532)
      • setup.exe (PID: 6404)
      • DismHost.exe (PID: 4008)
      • DismHost.exe (PID: 1388)
      • DismHost.exe (PID: 6668)
      • DismHost.exe (PID: 6876)

    • Reads the computer name

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)
      • DismHost.exe (PID: 4008)
      • DismHost.exe (PID: 1388)
      • DismHost.exe (PID: 6668)
      • DismHost.exe (PID: 6876)

    • The sample compiled with english language support

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)
      • powershell.exe (PID: 6240)
      • Dism.exe (PID: 6872)
      • Dism.exe (PID: 2516)
      • Dism.exe (PID: 5740)

    • Create files in a temporary directory

      • setup.exe (PID: 4896)
      • setup.exe (PID: 1532)
      • powershell.exe (PID: 6240)
      • Dism.exe (PID: 6872)
      • Dism.exe (PID: 2516)
      • Dism.exe (PID: 5740)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 960)
      • setup.exe (PID: 6404)

    • The executable file from the user directory is run by the Powershell process

      • setup.exe (PID: 1532)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4424)

    • Changes the registry key values via Powershell

      • setup.exe (PID: 6404)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6240)

    • Reads the software policy settings

      • powershell.exe (PID: 6240)

    • PyInstaller has been detected (YARA)

      • setup.exe (PID: 1532)

    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 7148)
      • powershell.exe (PID: 6240)
      • powershell.exe (PID: 3884)
      • conhost.exe (PID: 5136)
      • conhost.exe (PID: 4560)

    • Reads Environment values

      • DismHost.exe (PID: 4008)
      • DismHost.exe (PID: 6668)
      • DismHost.exe (PID: 1388)
      • DismHost.exe (PID: 6876)

    • Returns all items recursively from all subfolders (POWERSHELL)

      • powershell.exe (PID: 3884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:01:11 16:20:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.35
CodeSize: 171008
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0xc200
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
32
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs setup.exe setup.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs dismhost.exe no specs dism.exe dismhost.exe no specs dism.exe dismhost.exe no specs dism.exe dismhost.exe no specs powershell.exe no specs conhost.exe no specs reagentc.exe no specs powershell.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
960"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe—setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388C:\Users\admin\AppData\Local\Temp\563AA215-B51E-4ADD-89E1-171E763E8BB0\dismhost.exe {948CD5C0-36CB-43B8-8C7D-B017AF70B645}C:\Users\admin\AppData\Local\Temp\563AA215-B51E-4ADD-89E1-171E763E8BB0\DismHost.exe—Dism.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Host Servicing Process
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\563aa215-b51e-4add-89e1-171e763e8bb0\dismhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1532"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1912powershell -Command "$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2516"C:\WINDOWS\system32\Dism.exe" /online /set-nonremovableapppolicy /packagefamily:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy /nonremovable:0C:\Windows\System32\Dism.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Image Servicing Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dism.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3884powershell -Command "Remove-Item -Path \"C:\Windows\System32\Recovery\" -Recurse -Force"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4008powershell -Command "REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
41 973
Read events
41 896
Write events
12
Delete events
65

Modification events

(PID) Process:(5176) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications
Operation:writeName:ToastEnabled
Value:
0
(PID) Process:(856) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(1388) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(6240) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Operation:delete keyName:(default)
Value:
(PID) Process:(6668) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(6876) DismHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\EnterpriseUninstallBlockList
Operation:delete valueName:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy
Value:
(PID) Process:(5744) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(5744) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(5744) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(5744) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
330
Suspicious files
4
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\_bz2.pydexecutable
MD5:86D1B2A9070CD7D52124126A357FF067
SHA256:62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\_asyncio.pydexecutable
MD5:33D0B6DE555DDBBBD5CA229BFA91C329
SHA256:A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\_hashlib.pydexecutable
MD5:D4674750C732F0DB4C4DD6A83A9124FE
SHA256:CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:40877B3395DD815C524062B6E1360755
SHA256:B6D1B07F5722C566C6E97E30012DFA5EA7E2307468BA5A466EEF6D6F0051BF47
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:E075B4FD5BDC7BA20F82E9EFA5D29044
SHA256:AB7BFF07CED56AB79895F7749F5DBA20BE8DBC8370B373D9B98178DF99B91854
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:2E6110E93B94D1605062B404627AAE8B
SHA256:F5C798AB351FE7B2610BAB23D5DD3A69672BFE9FFE86214D373BB69CD81E94C7
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:DCAE341BA54F008862B979808FA03076
SHA256:24EFF95E03E5F29590D5ABA746171AD61F3E70A85ED2B1D7DB22BA21DC418E10
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:D23BE93C9DDD944AAC50C7BDCECE08EC
SHA256:178094A7C8A521075D18BD3AD4E2CBE7E759F48286939A83139AE3C20D274A8E
4896setup.exeC:\Users\admin\AppData\Local\Temp\_MEI48962\api-ms-win-core-fibers-l1-1-0.dllexecutable
MD5:386F95B018F74B93E163F9C7BAC0297E
SHA256:814EA0556A2B1A70609F3A2E9CB91640EE5C815E81E16069381204281FD7366F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
856
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
856
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.183
  • 23.48.23.181
  • 23.48.23.192
  • 23.48.23.156
  • 23.48.23.193
  • 23.48.23.143
  • 23.48.23.190
  • 23.48.23.155
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.78
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.71
  • 40.126.31.128
  • 20.190.159.68
  • 40.126.31.1
  • 20.190.159.64
  • 40.126.31.67
  • 40.126.31.0
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe