File name:

Installer.exe

Full analysis: https://app.any.run/tasks/7ac83b76-6baf-43a6-8581-1cf8781d3adc
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 15, 2026, 18:05:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
golang
arch-exec
arch-doc
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

E348631A2729A08A9790F2C85BFFC9D9

SHA1:

6BA2C6DA30A56BF978C0C5EEE532354687C8DBFC

SHA256:

08BBCA1E793987092B0FEE110128E2C380A85BFA736263D4A29DD7F858383158

SSDEEP:

49152:vjVhXOMJzZjRGN1D1xJY6o4gKTPJSI15oRbCcmLa0MmIzARy0yVrTvd9Dgmq4Sph:L+MJywc0I11cmuXURy0yxZ9DgeYy7u9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Installer.exe (PID: 3112)

    • Steals credentials from Web Browsers

      • Installer.exe (PID: 3112)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Changes the autorun value in the registry

      • powershell.exe (PID: 9208)

  • SUSPICIOUS

    • Possible stealing from crypto wallets

      • Installer.exe (PID: 3112)

    • Possible stealing from browsers

      • Installer.exe (PID: 3112)

    • Possible stealing of email data

      • Installer.exe (PID: 3112)

    • Searches for installed software

      • Installer.exe (PID: 3112)

    • Possible stealing of messenger data

      • Installer.exe (PID: 3112)

    • Possible stealing from password managers

      • Installer.exe (PID: 3112)

    • Possible stealing of FTP data

      • Installer.exe (PID: 3112)

    • Possible stealing from 2fa

      • Installer.exe (PID: 3112)

    • Possible stealing of VPN data

      • Installer.exe (PID: 3112)

    • Executes script without checking the security policy

      • powershell.exe (PID: 9208)

    • The process hides Powershell's copyright startup banner

      • Installer.exe (PID: 3112)

    • The process hide an interactive prompt from the user

      • Installer.exe (PID: 3112)

    • Starts POWERSHELL.EXE for commands execution

      • Installer.exe (PID: 3112)

    • The process bypasses the loading of PowerShell profile settings

      • Installer.exe (PID: 3112)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Multiple wallet extension IDs have been found

      • Installer.exe (PID: 3112)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Possible path obfuscation (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Loads Python modules

      • LicensingService.exe (PID: 5468)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 9208)

    • Process drops python dynamic module

      • powershell.exe (PID: 9208)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 9208)

  • INFO

    • Reads the machine GUID from the registry

      • Installer.exe (PID: 3112)
      • LicensingService.exe (PID: 5468)

    • The sample compiled with english language support

      • Installer.exe (PID: 3112)
      • powershell.exe (PID: 9208)

    • Reads the computer name

      • Installer.exe (PID: 3112)
      • LicensingService.exe (PID: 5468)

    • Checks supported languages

      • Installer.exe (PID: 3112)
      • LicensingService.exe (PID: 5468)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 9208)
      • LicensingService.exe (PID: 5468)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Disables trace logs

      • powershell.exe (PID: 9208)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Application based on Golang

      • Installer.exe (PID: 3112)

    • User-Agent configuration (POWERSHELL)

      • powershell.exe (PID: 9208)

    • Create files in a temporary directory

      • powershell.exe (PID: 9208)

    • Reads Environment values

      • LicensingService.exe (PID: 5468)

    • Creates files or folders in the user directory

      • powershell.exe (PID: 9208)

    • Python executable

      • LicensingService.exe (PID: 5468)

    • Launching a file from a Registry key

      • powershell.exe (PID: 9208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 3
CodeSize: 648704
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x69880
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: nationallyterrorist
FileVersion: 1.0.0.0
InternalName: offensivecontrollers
LegalCopyright: hungarianafghanistan
OriginalFileName: interested.exe
ProductName: behavioralscholarships
ProductVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start installer.exe updater.exe no specs updater.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe conhost.exe no specs svchost.exe slui.exe licensingservice.exe

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—Installer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3112"C:\Users\admin\Desktop\Installer.exe" C:\Users\admin\Desktop\Installer.exe
explorer.exe
User:
admin
Company:
nationallyterrorist
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
3636"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5468"C:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\LicensingService.exe" "C:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\LicensingService.exe.manifest"C:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\LicensingService.exe
powershell.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python
Version:
3.15.0a6
Modules
Images
c:\users\admin\appdata\roaming\intel\platform\winrt\a2631c734e58d571\licensingservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\roaming\intel\platform\winrt\a2631c734e58d571\vcruntime140.dll
c:\users\admin\appdata\roaming\intel\platform\winrt\a2631c734e58d571\python315.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5636C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7284"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7568"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8028"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—Installer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
12 923
Read events
12 922
Write events
1
Delete events
0

Modification events

(PID) Process:(9208) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Megatronic Develop Triple 47019
Value:
"C:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\LicensingService.exe" "C:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\LicensingService.exe.manifest"
Executable files
15
Suspicious files
4
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
9208powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z1epljm5.xe0.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8352updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:AD60AB60788764CA8AE91C42F099C864
SHA256:6A0062EF1E223A191A23FAEDA489AB9639979A8621E29289AB097253CC9C576F
9208powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jgtjjos0.ilg.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\_hashlib.pydexecutable
MD5:CBAEAC105368D515A4D1A6940DFBB1DA
SHA256:26E11F41BF2197C007CCB57DC98D939DD409C0C3D8DE77B31E19943F772EE8F8
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\python315.zipcompressed
MD5:D6E54E53978B3D55671595687D974681
SHA256:0E029C316B6BC7931064A1B5DD2F18213A0581BF447FFFBBF687E6CCA573AA21
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\sqlite3.dllexecutable
MD5:DD46150DB2866C834C57EF43C3D73AD2
SHA256:87C6B978C344588A467F85B90CC8B08A43F85AF0FBA63F7E8B2ACB020EA32624
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\_ctypes.pydexecutable
MD5:4C2B30EA5DDE6369C5E2F757CA4A42C1
SHA256:3D96BD2FCCEAC4B94AA4C39A2C28117B67FDEF2EFB85E8C70153A42232A993F3
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\unicodedata.pydexecutable
MD5:574E55857A21FE3A4A4AFB2EDAB6CA47
SHA256:AB9887DB8CC2BF76A91E7E17BC59B94A6771C6C4E7223142F352006D8131F9D7
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\python3.dllexecutable
MD5:F1C0A4A859622F79C0FA559196B3E693
SHA256:482B1C87A8BDD8770EC81F4B0E236DE21B5CF3D45A549DC0B051B09732A99DBE
9208powershell.exeC:\Users\admin\AppData\Roaming\Intel\Platform\WinRT\a2631c734e58d571\_queue.pydexecutable
MD5:14C76669397F108DE22E12F6B1CDE2C8
SHA256:8175BC5BA1D0A593972DDFEE43DF20C43F8A31A5002D7B9A4709CA3EAFD7E9D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
93
TCP/UDP connections
106
DNS requests
36
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
unknown
—
—
whitelisted
3112
Installer.exe
POST
200
193.221.201.247:443
https://microsoft.com/
unknown
binary
104 b
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
unknown
—
—
whitelisted
3112
Installer.exe
POST
200
193.221.201.247:443
https://microsoft.com/
unknown
binary
359 b
whitelisted
3112
Installer.exe
POST
200
193.221.201.247:443
https://microsoft.com/a_KnH_X9x-JK.v2uB
unknown
binary
50.2 Kb
whitelisted
3112
Installer.exe
POST
200
193.221.201.247:443
https://microsoft.com/Pau_v.Yr7_~-phLeNCfqOY_wPcV~FPPr@bI_4_tk2z-
unknown
—
—
whitelisted
356
svchost.exe
POST
400
20.190.160.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
356
svchost.exe
POST
200
20.190.160.2:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
356
svchost.exe
POST
400
20.190.160.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
2600
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8680
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.204.155:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
2.16.204.158:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.204.155
  • 2.16.204.145
  • 2.16.204.147
  • 2.16.204.158
  • 2.16.204.146
  • 2.16.204.151
  • 2.16.204.160
whitelisted
th.bing.com
  • 2.16.204.158
  • 2.16.204.155
  • 2.16.204.160
  • 2.16.204.151
  • 2.16.204.146
  • 2.16.204.147
  • 2.16.204.145
whitelisted
self.events.data.microsoft.com
  • 104.208.16.95
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
google.com
  • 142.250.201.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.67
  • 20.190.160.5
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.17
  • 20.190.160.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.18
  • 2.16.164.99
  • 2.16.164.49
  • 23.216.77.5
  • 23.216.77.43
  • 23.216.77.18
  • 23.216.77.25
  • 23.216.77.4
  • 23.216.77.37
  • 23.216.77.32
  • 23.216.77.35
  • 23.216.77.29
whitelisted

Threats

PID
Process
Class
Message
2600
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2292
svchost.exe
Misc activity
INFO [ANY.RUN] .pw TLD domain request
9208
powershell.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
2292
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
2292
svchost.exe
Potentially Bad Traffic
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
2292
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
5468
LicensingService.exe
Misc activity
INFO [ANY.RUN] Connection to IP from commonly abused ASN (AS214943 RAILNET)
5468
LicensingService.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 28
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Installer.exe