File name:

eGovClientSetup_2.1.4.1 (1).zip

Full analysis: https://app.any.run/tasks/ebfd4d33-65dd-4ed3-9b73-19252e5a0c2f
Verdict: Malicious activity
Analysis date: July 07, 2025, 05:57:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

07F9B5F2D0ED5B7A3051BDDA5AF47C3C

SHA1:

6BB1499F57519E87C26A49E7FEDC495A6A13CB98

SHA256:

F2CD012CD60452CBA4D8B832E245B019BFC490606696D28F10D49F4F69906C4F

SSDEEP:

49152:yp0xv8th3dsMLwNcPFAU3JRy6qy+uLry4VT/uSHFfDIUHbP03Mh6RpUv2i2l3Wbe:Mft9SMLwaeU3JRy6qyBqg2SHFfDF83M2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1296)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • msiexec.exe (PID: 3584)
      • setup.exe (PID: 1332)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 1332)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)

    • Starts a Microsoft application from unusual location

      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 3672)

    • Creates file in the systems drive root

      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1740)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3584)

    • Reads security settings of Internet Explorer

      • eGovClient.exe (PID: 7064)
      • setup.exe (PID: 1332)

    • Reads Microsoft Outlook installation path

      • eGovClient.exe (PID: 7064)

    • Reads Internet Explorer settings

      • eGovClient.exe (PID: 7064)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1296)
      • msiexec.exe (PID: 3584)
      • msiexec.exe (PID: 1636)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1296)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • msiexec.exe (PID: 1636)
      • msiexec.exe (PID: 3584)
      • setup.exe (PID: 1332)

    • Manual execution by a user

      • setup.exe (PID: 1332)
      • eGovClient.exe (PID: 7064)

    • Reads the computer name

      • setup.exe (PID: 1332)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • msiexec.exe (PID: 3584)
      • Setup.exe (PID: 5504)
      • msiexec.exe (PID: 1760)
      • msiexec.exe (PID: 2144)
      • eGovClient.exe (PID: 7064)

    • Checks supported languages

      • setup.exe (PID: 1332)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • Setup.exe (PID: 5504)
      • msiexec.exe (PID: 3584)
      • msiexec.exe (PID: 2144)
      • msiexec.exe (PID: 1760)
      • eGovClient.exe (PID: 7064)

    • Create files in a temporary directory

      • setup.exe (PID: 1332)
      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • Setup.exe (PID: 5504)
      • msiexec.exe (PID: 2144)
      • msiexec.exe (PID: 1760)

    • Process checks computer location settings

      • setup.exe (PID: 1332)

    • Reads the machine GUID from the registry

      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)
      • msiexec.exe (PID: 3584)
      • eGovClient.exe (PID: 7064)
      • setup.exe (PID: 1332)

    • Creates files or folders in the user directory

      • setup.exe (PID: 1332)
      • msiexec.exe (PID: 1636)
      • eGovClient.exe (PID: 7064)

    • Reads CPU info

      • Setup.exe (PID: 5504)

    • Checks proxy server information

      • msiexec.exe (PID: 1636)
      • eGovClient.exe (PID: 7064)
      • slui.exe (PID: 6788)
      • setup.exe (PID: 1332)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1636)

    • Reads the software policy settings

      • msiexec.exe (PID: 1636)
      • msiexec.exe (PID: 3584)
      • eGovClient.exe (PID: 7064)
      • slui.exe (PID: 6788)
      • setup.exe (PID: 1332)

    • The sample compiled with japanese language support

      • NDP472-KB4054530-x86-x64-AllOS-JPN.exe (PID: 4844)

    • Manages system restore points

      • SrTasks.exe (PID: 3844)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3584)

    • Disables trace logs

      • eGovClient.exe (PID: 7064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:01:20 13:38:50
ZipCRC: 0x0b73eaa5
ZipCompressedSize: 1157788
ZipUncompressedSize: 2544128
ZipFileName: eGovClientSetup.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
14
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe ndp472-kb4054530-x86-x64-allos-jpn.exe no specs ndp472-kb4054530-x86-x64-allos-jpn.exe setup.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs egovclient.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\eGovClientSetup_2.1.4.1 (1).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1332"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
17.0.35410.144 built by: d17.12
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1636"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\admin\Desktop\eGovClientSetup.msi" C:\Windows\SysWOW64\msiexec.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1740C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760C:\Windows\syswow64\MsiExec.exe -Embedding 81BBFC10A1C4F2D856D3F19EA02EC14EC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2144C:\Windows\syswow64\MsiExec.exe -Embedding DF1C088738FE22D0F9CABB07A098B9F8 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3584C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3672"C:\Users\admin\AppData\Local\Temp\VSD9114.tmp\DotNetFX472\NDP472-KB4054530-x86-x64-AllOS-JPN.exe" /q /norestart /skipenucheck /ChainingPackage FullX64ClickOnceC:\Users\admin\AppData\Local\Temp\VSD9114.tmp\DotNetFX472\NDP472-KB4054530-x86-x64-AllOS-JPN.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.7.2 (JPN) Setup
Exit code:
3221226540
Version:
4.7.03062.00
Modules
Images
c:\users\admin\appdata\local\temp\vsd9114.tmp\dotnetfx472\ndp472-kb4054530-x86-x64-allos-jpn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3844C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
18 227
Read events
17 901
Write events
309
Delete events
17

Modification events

(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\eGovClientSetup_2.1.4.1 (1).zip
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
21
Suspicious files
41
Text files
63
Unknown types
13

Dropped files

PID
Process
Filename
Type
4844NDP472-KB4054530-x86-x64-AllOS-JPN.exeC:\2150f0d1662aefb63796\x64-Windows10.0-KB4054604-x64.cab —
MD5:—
SHA256:—
4844NDP472-KB4054530-x86-x64-AllOS-JPN.exeC:\2150f0d1662aefb63796\x64-Windows10.0-KB4073134-x64.cab —
MD5:—
SHA256:—
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.18713\eGovClientSetup.msiexecutable
MD5:225EBF3465644C8B5269FB26EFE2BFD7
SHA256:F89321A497C0D056ACF1C4AA4A1069DD1613822C539FFE62BE374533D71AC2C9
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.18713\setup.exeexecutable
MD5:6A495B84743F6DA931E341B109B6CE81
SHA256:613B6E9722009D49A5625A79F9D7CADB781BD591F834B3310ACFCC49750BDFA0
1332setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:7FB190242C617197D474A9E82248E041
SHA256:5ACE742228D554BC788BE338C8E40DAD35CE300BE93C2EA129D3957CF36F0981
1332setup.exeC:\Users\admin\AppData\Local\Temp\VSD9114.tmp\setup.exeexecutable
MD5:6A495B84743F6DA931E341B109B6CE81
SHA256:613B6E9722009D49A5625A79F9D7CADB781BD591F834B3310ACFCC49750BDFA0
1332setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:0F7B8F6A846AA9CA52FA562DDDCDB5ED
SHA256:AFF90E65A81289B80D1FCC5E71B3D88E5D1AAFE22CE358EB6E28A56D1845263D
1332setup.exeC:\Users\admin\AppData\Local\Temp\VSD9114.tmp\DotNetFX472\NDP472-KB4054530-x86-x64-AllOS-JPN.exeexecutable
MD5:C6C5F6575FD8E3CAFC3DC98A4A6F1179
SHA256:CC4D03F15D8047832B9E0CB08441EC4037C26D8969B87F255E5AF9DBA9B60F09
4844NDP472-KB4054530-x86-x64-AllOS-JPN.exeC:\2150f0d1662aefb63796\watermark.bmpimage
MD5:B0075CEE80173D764C0237E840BA5879
SHA256:AB18374B3AAB10E5979E080D0410579F9771DB888BA1B80A5D81BA8896E2D33A
4844NDP472-KB4054530-x86-x64-AllOS-JPN.exeC:\2150f0d1662aefb63796\header.bmpimage
MD5:41C22EFA84CA74F0CE7076EB9A482E38
SHA256:255025A0D79EF2DAC04BD610363F966EF58328400BF31E1F8915E676478CD750
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
44
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1332
setup.exe
GET
302
95.100.186.9:80
http://go.microsoft.com/fwlink/?LinkId=863258&clcid=0x411
unknown
—
—
whitelisted
6876
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1332
setup.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6812
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6812
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1636
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
1636
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6492
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6876
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6876
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.142
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.2
  • 20.190.160.64
  • 20.190.160.4
  • 20.190.160.17
  • 20.190.160.130
  • 40.126.32.140
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
go.microsoft.com
  • 95.100.186.9
  • 23.218.210.69
whitelisted
download.visualstudio.microsoft.com
  • 2.16.168.105
  • 2.16.168.102
whitelisted

Threats

No threats detected
Process
Message
Setup.exe
The operation completed successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
eGovClientSetup_2.1.4.1 (1).zip