URL:

https://disko.hb.ru-msk.vkcs.cloud/cloud/win/setup/offline/CloudSetupFull.exe

Full analysis: https://app.any.run/tasks/67b0b420-47b2-4088-b567-32b14751c6d9
Verdict: Malicious activity
Analysis date: December 25, 2023, 09:56:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

149CEA5D6D9DADD3996A29DA40054F9A

SHA1:

54C0B104A8EFC07E85296D0C30D1D161E977744A

SHA256:

F86D625CC17D2BFB5FFFC1169F52CF594A06B8FE077ED8625C68CB0FBED5BFAF

SSDEEP:

3:N8UE1AIyBvBKWWpVKYDJbdwcJJ:2U2AVv8VlVbdwcJJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • Disk-O-Deps.tmp (PID: 2244)

    • Create files in the Startup directory

      • CloudSetupFull.tmp (PID: 712)

    • Creates a writable file in the system directory

      • Disk-O-Deps.tmp (PID: 2244)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • CloudSetupFull.tmp (PID: 712)
      • Disk-O-Deps.tmp (PID: 2244)

    • Reads settings of System Certificates

      • CloudSetupFull.tmp (PID: 712)
      • DiskO.exe (PID: 2760)

    • Reads the Internet Settings

      • CloudSetupFull.tmp (PID: 712)
      • DiskO.exe (PID: 2760)

    • Drops a system driver (possible attempt to evade defenses)

      • Disk-O-Deps.tmp (PID: 2244)

    • Detected use of alternative data streams (AltDS)

      • DiskO.exe (PID: 2760)

    • The process verifies whether the antivirus software is installed

      • DiskO.exe (PID: 2760)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 128)

    • The process uses the downloaded file

      • iexplore.exe (PID: 128)
      • CloudSetupFull.tmp (PID: 712)

    • Checks supported languages

      • CloudSetupFull.exe (PID: 2000)
      • CloudSetupFull.tmp (PID: 712)
      • Disk-O-Deps.exe (PID: 2096)
      • Disk-O-Deps.tmp (PID: 2244)
      • Cloud.exe (PID: 2052)
      • DiskO.exe (PID: 2760)
      • pcnsl_free.exe (PID: 2828)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2032)
      • CloudSetupFull.exe (PID: 2000)
      • Disk-O-Deps.exe (PID: 2096)
      • Disk-O-Deps.tmp (PID: 2244)
      • DiskO.exe (PID: 2760)
      • CloudSetupFull.tmp (PID: 712)

    • Create files in a temporary directory

      • CloudSetupFull.exe (PID: 2000)
      • CloudSetupFull.tmp (PID: 712)
      • Disk-O-Deps.exe (PID: 2096)

    • Reads the computer name

      • CloudSetupFull.tmp (PID: 712)
      • Disk-O-Deps.tmp (PID: 2244)
      • DiskO.exe (PID: 2760)

    • Reads the machine GUID from the registry

      • CloudSetupFull.tmp (PID: 712)
      • DiskO.exe (PID: 2760)

    • Creates files or folders in the user directory

      • CloudSetupFull.tmp (PID: 712)
      • DiskO.exe (PID: 2760)

    • Process drops legitimate windows executable

      • CloudSetupFull.tmp (PID: 712)

    • Process checks computer location settings

      • DiskO.exe (PID: 2760)

    • The process drops C-runtime libraries

      • CloudSetupFull.tmp (PID: 712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
10
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe cloudsetupfull.exe no specs cloudsetupfull.tmp disk-o-deps.exe disk-o-deps.tmp no specs regsvr32.exe cloud.exe no specs disko.exe pcnsl_free.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Internet Explorer\iexplore.exe" "https://disko.hb.ru-msk.vkcs.cloud/cloud/win/setup/offline/CloudSetupFull.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
632"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\disko\winfsp_x86.dll"C:\Windows\System32\regsvr32.exe
Disk-O-Deps.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
712"C:\Users\admin\AppData\Local\Temp\is-3VD33.tmp\CloudSetupFull.tmp" /SL5="$3014A,47692996,918528,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\CloudSetupFull.exe" C:\Users\admin\AppData\Local\Temp\is-3VD33.tmp\CloudSetupFull.tmp
CloudSetupFull.exe
User:
admin
Company:
Mail.Ru Group
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3vd33.tmp\cloudsetupfull.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2000"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\CloudSetupFull.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\CloudSetupFull.exe—iexplore.exe
User:
admin
Company:
Mail.Ru Group
Integrity Level:
MEDIUM
Description:
Cloud Setup
Exit code:
0
Version:
23.08.0079
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\cloudsetupfull.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2032"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2052"C:\Users\admin\AppData\Local\Mail.Ru\Disk-O\Cloud.exe"C:\Users\admin\AppData\Local\Mail.Ru\Disk-O\Cloud.exe—CloudSetupFull.tmp
User:
admin
Company:
Mail.Ru
Integrity Level:
MEDIUM
Description:
Disko Mail.Ru
Exit code:
7771777
Version:
23.08.0079
Modules
Images
c:\users\admin\appdata\local\mail.ru\disk-o\cloud.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2096"C:\Users\admin\AppData\Local\Temp\is-HOBF0.tmp\Disk-O-Deps.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCLOSEAPPLICATIONS /DISKO_INSTALLPATH="C:\Users\admin\AppData\Local\Mail.Ru\Disk-O"C:\Users\admin\AppData\Local\Temp\is-HOBF0.tmp\Disk-O-Deps.exe
CloudSetupFull.tmp
User:
admin
Company:
Mail.Ru Group
Integrity Level:
HIGH
Description:
Disk-O-Deps Mail.Ru Setup
Exit code:
0
Version:
23.08.0079
Modules
Images
c:\users\admin\appdata\local\temp\is-hobf0.tmp\disk-o-deps.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2244"C:\Users\admin\AppData\Local\Temp\is-7MSDQ.tmp\Disk-O-Deps.tmp" /SL5="$201D4,1148107,921088,C:\Users\admin\AppData\Local\Temp\is-HOBF0.tmp\Disk-O-Deps.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCLOSEAPPLICATIONS /DISKO_INSTALLPATH="C:\Users\admin\AppData\Local\Mail.Ru\Disk-O"C:\Users\admin\AppData\Local\Temp\is-7MSDQ.tmp\Disk-O-Deps.tmp—Disk-O-Deps.exe
User:
admin
Company:
Mail.Ru Group
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-7msdq.tmp\disk-o-deps.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2760 -fakeargC:\Users\admin\AppData\Local\Mail.Ru\Disk-O\vcurrent\DiskO.exe
Cloud.exe
User:
admin
Company:
Mail.ru
Integrity Level:
MEDIUM
Description:
Cloud Mail.ru
Exit code:
1073741845
Version:
23.08.0079
Modules
Images
c:\users\admin\appdata\local\mail.ru\disk-o\vcurrent\disko.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2828"C:\Users\admin\AppData\Local\Mail.Ru\Disk-O\vcurrent\pcnsl_free.exe" /run:ia 2760C:\Users\admin\AppData\Local\Mail.Ru\Disk-O\vcurrent\pcnsl_free.exe—DiskO.exe
User:
admin
Company:
Mail.Ru
Integrity Level:
MEDIUM
Description:
User Interface Application
Exit code:
0
Version:
5.91.2210.467
Modules
Images
c:\users\admin\appdata\local\mail.ru\disk-o\vcurrent\pcnsl_free.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
25 557
Read events
25 450
Write events
95
Delete events
12

Modification events

(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
211
Suspicious files
212
Text files
32
Unknown types
4

Dropped files

PID
Process
Filename
Type
2032iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\CloudSetupFull.exe.5fuvru2.partial —
MD5:—
SHA256:—
128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\CloudSetupFull.exe —
MD5:—
SHA256:—
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:901DDFD4059B98E40F701F139A1EE8EB
SHA256:4D2A1AFC94F3D20BE0931B36E2E282F5ED15E381094684A346640FF2E5344646
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81Bbinary
MD5:194749DB32D53216B3C8CABCD3F958E2
SHA256:B96C2CFB9A5AA0EF6A1F409010E56D0324A401B52313472E4109751CFB220A50
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:D23E319FFD7529DA3A95F1FF21F4F548
SHA256:5AA3D5A58D0033BFE9B89973AA8217CFEEB515BD29BDE01656BC845CA3346A1D
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:7FC37A1B50309E1DBABF803C3B9403F8
SHA256:1C245A1C0A9835DCB90E8A348EB23B5A19B7B5E766B8519B33DD9C7F5B528C6B
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81Bbinary
MD5:3E20FC411D425ABA31F84FCC0F11C40C
SHA256:5EE106E53CDA8DF1C4D3364DC27D38BA2A0057239299D22EECABDEE34FE89655
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:17A9C1397F748C4658FED26A6224A365
SHA256:0AD0F3C5B28A0F43915047586A2A179D4B860F28FC7B8A80369B9F751C98F58C
2032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\025AE8A57DFC1E833AF3E802C894D84Cbinary
MD5:1A779FB48F88198D3C21149FED07444F
SHA256:7BEB0BE412226EB9702215C6839CC4A1FCF293432C8C09AEF936D405A56D8472
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
29
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2032
iexplore.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7a9d8baceff24343
unknown
compressed
4.66 Kb
unknown
2032
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
unknown
binary
1.40 Kb
unknown
2032
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
binary
1.41 Kb
unknown
128
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fa4f1dfa99832483
unknown
—
—
unknown
128
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a10a16456a3ace15
unknown
—
—
unknown
2032
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDCn5qIN%2FqE%2BBfBVzoQ%3D%3D
unknown
binary
1.40 Kb
unknown
128
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4245a775decf102e
unknown
—
—
unknown
2032
iexplore.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?129d20c84d8c4223
unknown
compressed
4.66 Kb
unknown
128
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
128
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2032
iexplore.exe
95.163.53.117:443
disko.hb.ru-msk.vkcs.cloud
LLC VK
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2032
iexplore.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2032
iexplore.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
128
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
128
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
128
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
712
CloudSetupFull.tmp
95.163.59.244:443
cloud.radar.imgsmail.ru
LLC VK
RU
unknown

DNS requests

Domain
IP
Reputation
disko.hb.ru-msk.vkcs.cloud
  • 95.163.53.117
unknown
ctldl.windowsupdate.com
  • 184.24.77.194
  • 184.24.77.202
  • 93.184.221.240
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
cloud.radar.imgsmail.ru
  • 95.163.59.244
  • 95.163.59.246
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
Process
Message
regsvr32.exe
FspFsctlRegister = 0
regsvr32.exe
FspEventLogRegister = 0
regsvr32.exe
FspNpRegister = 0
DiskO.exe
QWindowsEGLStaticContext::create: When using ANGLE, check if d3dcompiler_4x.dll is available
DiskO.exe
QWindowsEGLStaticContext::create: Could not initialize EGL display: error 0x3001
DiskO.exe
QWindowsEGLStaticContext::create: When using ANGLE, check if d3dcompiler_4x.dll is available
DiskO.exe
QWindowsEGLStaticContext::create: Could not initialize EGL display: error 0x3001
DiskO.exe
QWindowsEGLStaticContext::create: Could not initialize EGL display: error 0x3001
DiskO.exe
QWindowsEGLStaticContext::create: When using ANGLE, check if d3dcompiler_4x.dll is available
DiskO.exe
qml: Qml wrong languade :cloud_ru
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://disko.hb.ru-msk.vkcs.cloud/cloud/win/setup/offline/CloudSetupFull.exe