File name:

dwagent.exe

Full analysis: https://app.any.run/tasks/1171068c-0df6-4976-86d2-d94ad2e852a9
Verdict: Malicious activity
Analysis date: January 29, 2025, 08:32:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 8 sections
MD5:

B10D12B91357828FA4FF83729A3840F3

SHA1:

9CE3B4ABCDC314449A341A19579578DFAF38105A

SHA256:

04313637D81F1EE9D55BBF82713C89BA78C8C593C5ED2289BF5B79A51C8D227E

SSDEEP:

98304:meMy7RXVGMBpsjMOher5vw+Owk0tBVIFcGIw9OWUEUVmnUBzdskLBOtf0CQJ41Sb:fQ78S5wkxk5Dp9Jb9V1i3DhA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • dwagsvc.exe (PID: 6348)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 4320)

    • There is functionality for taking screenshot (YARA)

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 1020)
      • dwagent.exe (PID: 4320)
      • dwagent.exe (PID: 6316)
      • dwagent.exe (PID: 4716)

    • Process drops legitimate windows executable

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 4320)

    • Process drops python dynamic module

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 4320)

    • Reads security settings of Internet Explorer

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 1020)
      • dwaglnc.exe (PID: 1856)
      • dwaglnc.exe (PID: 4672)

    • The process drops C-runtime libraries

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 4320)

    • Starts CMD.EXE for commands execution

      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 4320)
      • dwagent.exe (PID: 1520)
      • dwagent.exe (PID: 6316)
      • dwagent.exe (PID: 4716)

    • Application launched itself

      • dwagent.exe (PID: 6392)

    • Loads Python modules

      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 4320)
      • dwagent.exe (PID: 1520)
      • dwagent.exe (PID: 6316)
      • dwagent.exe (PID: 4716)

    • Executes as Windows Service

      • dwagsvc.exe (PID: 628)

    • Reads the date of Windows installation

      • dwaglnc.exe (PID: 1856)
      • dwaglnc.exe (PID: 4672)

    • Creates a software uninstall entry

      • dwagsvc.exe (PID: 7024)

  • INFO

    • Reads the computer name

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 1020)
      • dwagent.exe (PID: 4320)
      • dwagsvc.exe (PID: 5696)
      • dwagsvc.exe (PID: 6856)
      • dwagsvc.exe (PID: 1488)
      • dwagsvc.exe (PID: 628)
      • dwagent.exe (PID: 1520)
      • dwagsvc.exe (PID: 6800)
      • dwaglnc.exe (PID: 1856)
      • dwagsvc.exe (PID: 7024)
      • dwagent.exe (PID: 4716)
      • dwagent.exe (PID: 6316)
      • dwaglnc.exe (PID: 4672)

    • Checks supported languages

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 1020)
      • dwagent.exe (PID: 4320)
      • dwagsvc.exe (PID: 5696)
      • dwagsvc.exe (PID: 6800)
      • dwagsvc.exe (PID: 6856)
      • dwagsvc.exe (PID: 1488)
      • dwagent.exe (PID: 1520)
      • dwagsvc.exe (PID: 628)
      • dwagsvc.exe (PID: 7160)
      • dwaglnc.exe (PID: 1856)
      • dwagent.exe (PID: 6316)
      • dwagsvc.exe (PID: 2844)
      • dwagsvc.exe (PID: 7024)
      • dwagsvc.exe (PID: 6348)
      • dwagent.exe (PID: 4716)
      • dwaglnc.exe (PID: 4672)

    • Create files in a temporary directory

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 4320)

    • The sample compiled with english language support

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 4320)

    • Process checks computer location settings

      • dwagent.exe (PID: 6392)
      • dwagent.exe (PID: 1020)
      • dwaglnc.exe (PID: 1856)
      • dwaglnc.exe (PID: 4672)

    • Python executable

      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 4320)
      • dwagent.exe (PID: 1520)
      • dwagent.exe (PID: 6316)
      • dwagent.exe (PID: 4716)

    • Checks operating system version

      • dwagent.exe (PID: 7124)
      • dwagent.exe (PID: 4320)
      • dwagent.exe (PID: 1520)
      • dwagent.exe (PID: 6316)
      • dwagent.exe (PID: 4716)

    • Creates files in the program directory

      • dwagent.exe (PID: 4320)
      • dwagsvc.exe (PID: 628)
      • dwagent.exe (PID: 1520)
      • dwagent.exe (PID: 6316)
      • dwagsvc.exe (PID: 7024)
      • dwagent.exe (PID: 4716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.1)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:11:18 12:45:44+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.3
CodeSize: 291328
InitializedDataSize: 355328
UninitializedDataSize: 26624
EntryPoint: 0x1490
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
46
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start dwagent.exe dwagent.exe no specs cmd.exe no specs conhost.exe no specs dwagent.exe dwagent.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs dwagsvc.exe no specs dwagent.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe cmd.exe no specs conhost.exe no specs dwaglnc.exe no specs dwagent.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs dwagsvc.exe no specs dwaglnc.exe no specs dwagent.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
628"C:\Program Files\DWAgent\native\dwagsvc.exe" runC:\Program Files\DWAgent\native\dwagsvc.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\program files\dwagent\native\dwagsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\AppData\Local\Temp\dwagent.exe" "-asadmin=C:\Users\admin\AppData\Local\Temp\dwagent20250129083219\\"C:\Users\admin\AppData\Local\Temp\dwagent.exe
dwagent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dwagent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1488"C:\Program Files\DWAgent\native\dwagsvc.exe" startServiceC:\Program Files\DWAgent\native\dwagsvc.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\dwagent\native\dwagsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1520"C:\Program Files\DWAgent\runtime\dwagent.exe" -S -m agent -filelogC:\Program Files\DWAgent\runtime\dwagent.exe
dwagsvc.exe
User:
SYSTEM
Company:
Python Software Foundation
Integrity Level:
SYSTEM
Description:
Python
Version:
3.11.9
Modules
Images
c:\program files\dwagent\runtime\dwagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\dwagent\runtime\vcruntime140.dll
c:\program files\dwagent\runtime\python311.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1856"C:\Program Files\DWAgent\native\dwaglnc.exe" systrayC:\Program Files\DWAgent\native\dwaglnc.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\dwagent\native\dwaglnc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2804C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—dwagent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2844"C:\Program Files\DWAgent\native\dwagsvc.exe" removeShortcutsC:\Program Files\DWAgent\native\dwagsvc.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\dwagent\native\dwagsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 173
Read events
3 167
Write events
5
Delete events
1

Modification events

(PID) Process:(7160) dwagsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:DWAgentMon
Value:
(PID) Process:(6348) dwagsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:DWAgentMon
Value:
"C:\Program Files\DWAgent\native\dwaglnc.exe" systray
(PID) Process:(7024) dwagsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DWAgent
Operation:writeName:DisplayName
Value:
DWAgent
(PID) Process:(7024) dwagsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DWAgent
Operation:writeName:DisplayIcon
Value:
C:\Program Files\DWAgent\ui\images\logo.ico
(PID) Process:(7024) dwagsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DWAgent
Operation:writeName:InstallLocation
Value:
C:\Program Files\DWAgent
(PID) Process:(7024) dwagsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DWAgent
Operation:writeName:UninstallString
Value:
"C:\Program Files\DWAgent\native\dwaglnc.exe" uninstall
Executable files
91
Suspicious files
1 360
Text files
164
Unknown types
0

Dropped files

PID
Process
Filename
Type
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\win.7z —
MD5:—
SHA256:—
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\runtimepy2.7z —
MD5:—
SHA256:—
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\runtimepy3.7z —
MD5:—
SHA256:—
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\cacerts.pemtext
MD5:75E9EBCEDD501B1FD93A3BB7C5F68A59
SHA256:D309171C54A3C5ABE71A910EFC3F48D0586B94AB9D3AB029DED76B36D72DDF5E
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\LICENSES\coretext
MD5:CFD7D66D2864C38232EC1EF20B27C13A
SHA256:CDE215E5B42363EB28CA2462C4558FF4807B38F383C537624C31E44657AC58F4
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\communication.pytext
MD5:BBA6D4707661D3C5C085E3FEBB490D64
SHA256:FA57CA1D9838278D17BC088F1ED66DDAE9FD60F4246FF753B47EF290A14DEECD
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\ui\images\activities_logo.bmpimage
MD5:C96F5BCF310AE61596F5571BF9EDC16F
SHA256:15B89F3DAB535AE859274864511ACEA1163A12C7AB1D6D7E9EB6008993AF31B3
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\installer.pytext
MD5:9CEE6D24FAC8EFF02BBC698E9F88D21F
SHA256:0C8D48E98358B4BDA521564AD2AF73E733C94E79DABD28843BFFBAEF1B602EDE
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\ipc.pytext
MD5:C5D804450DEA060F85CC586990F70AC3
SHA256:7F5BC8D46F41A874AE5D4975DDC732482413020D498E80AE5465AC4B1C8806AE
6392dwagent.exeC:\Users\admin\AppData\Local\Temp\dwagent20250129083219\LICENSES\uitext
MD5:CFD7D66D2864C38232EC1EF20B27C13A
SHA256:CDE215E5B42363EB28CA2462C4558FF4807B38F383C537624C31E44657AC58F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6872
SIHClient.exe
GET
200
184.30.230.103:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6872
SIHClient.exe
GET
200
184.30.230.103:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3848
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
95.100.110.91:443
www.bing.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.230.103
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.68
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
whitelisted
www.bing.com
  • 95.100.110.91
  • 95.100.110.78
  • 95.100.110.72
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dwagent.exe