File name:

quickmac.exe

Full analysis: https://app.any.run/tasks/d98b3e47-ac06-4cde-819e-91a6df35742a
Verdict: Malicious activity
Analysis date: May 13, 2025, 22:34:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

68771177F919C476CD1CDDEB4A6E5B76

SHA1:

DD1604B37789CD5BB68684CC8E906A682989086C

SHA256:

0C042AB9708C25950DD2016B40D483E510A7A4238D09E912D79FD7C47804092A

SSDEEP:

98304:ZguexuNOvh+Pe5sdQJZKRXmqBvCSYH+81HT78Wc6GNSJhZgSGYKOkWX6Slc/Zas1:/r0aCz1IJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • quickmac.tmp (PID: 6476)

    • Registers / Runs the DLL via REGSVR32.EXE

      • qm.exe (PID: 516)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • quickmac.tmp (PID: 2384)
      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 516)
      • qm.exe (PID: 4652)

    • Executable content was dropped or overwritten

      • quickmac.exe (PID: 5072)
      • quickmac.exe (PID: 904)
      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 516)

    • Reads the Windows owner or organization settings

      • quickmac.tmp (PID: 6476)

    • Drops a system driver (possible attempt to evade defenses)

      • quickmac.tmp (PID: 6476)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 5576)
      • regsvr32.exe (PID: 1056)

    • Executes as Windows Service

      • qmserv.exe (PID: 6944)

    • Reads Microsoft Outlook installation path

      • qm.exe (PID: 4652)

    • Detected use of alternative data streams (AltDS)

      • qm.exe (PID: 4652)

    • Reads Internet Explorer settings

      • qm.exe (PID: 4652)

  • INFO

    • Checks supported languages

      • quickmac.tmp (PID: 2384)
      • quickmac.exe (PID: 5072)
      • quickmac.exe (PID: 904)
      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 516)
      • qmserv.exe (PID: 6944)
      • qm.exe (PID: 5124)
      • qm.exe (PID: 4652)

    • Create files in a temporary directory

      • quickmac.exe (PID: 5072)
      • quickmac.exe (PID: 904)
      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 4652)

    • Reads the computer name

      • quickmac.tmp (PID: 2384)
      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 516)
      • qmserv.exe (PID: 6944)
      • qm.exe (PID: 5124)
      • qm.exe (PID: 4652)

    • Process checks computer location settings

      • quickmac.tmp (PID: 2384)
      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 516)

    • Creates files in the program directory

      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 516)

    • The sample compiled with english language support

      • quickmac.tmp (PID: 6476)
      • qm.exe (PID: 4652)

    • The sample compiled with spanish language support

      • quickmac.tmp (PID: 6476)

    • Detects InnoSetup installer (YARA)

      • quickmac.exe (PID: 5072)
      • quickmac.tmp (PID: 2384)

    • Compiled with Borland Delphi (YARA)

      • quickmac.exe (PID: 5072)
      • quickmac.tmp (PID: 2384)

    • Creates a software uninstall entry

      • quickmac.tmp (PID: 6476)

    • Creates files or folders in the user directory

      • qm.exe (PID: 4652)

    • Checks proxy server information

      • qm.exe (PID: 4652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:06 14:39:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x117dc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Gintaras Didžgalvis
FileDescription: Quick Macros Setup
FileVersion:
LegalCopyright:
ProductName: Quick Macros
ProductVersion: 2.4.12.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
13
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start quickmac.exe quickmac.tmp no specs quickmac.exe quickmac.tmp sppextcomobj.exe no specs slui.exe no specs qm.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs qmserv.exe no specs qm.exe no specs qm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Program Files (x86)\Quick Macros 2\qm.exe" /!iC:\Program Files (x86)\Quick Macros 2\qm.exe
quickmac.tmp
User:
admin
Company:
Gintaras Didzgalvis
Integrity Level:
HIGH
Description:
Quick Macros
Exit code:
0
Version:
2.4.12.2
Modules
Images
c:\program files (x86)\quick macros 2\qm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
904"C:\Users\admin\AppData\Local\Temp\quickmac.exe" /SPAWNWND=$1602DC /NOTIFYWND=$902AE C:\Users\admin\AppData\Local\Temp\quickmac.exe
quickmac.tmp
User:
admin
Company:
Gintaras Didžgalvis
Integrity Level:
HIGH
Description:
Quick Macros Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\quickmac.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1056 /s "C:\Program Files (x86)\Quick Macros 2\ver 0x2040C02\qmshex64.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2384"C:\Users\admin\AppData\Local\Temp\is-11KQT.tmp\quickmac.tmp" /SL5="$902AE,4834674,121344,C:\Users\admin\AppData\Local\Temp\quickmac.exe" C:\Users\admin\AppData\Local\Temp\is-11KQT.tmp\quickmac.tmp—quickmac.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-11kqt.tmp\quickmac.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3768C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4040"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4652"C:\Program Files (x86)\Quick Macros 2\qm.exe" /!*vC:\Program Files (x86)\Quick Macros 2\qm.exe—qmserv.exe
User:
admin
Company:
Gintaras Didzgalvis
Integrity Level:
HIGH
Description:
Quick Macros
Version:
2.4.12.2
Modules
Images
c:\program files (x86)\quick macros 2\qm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5072"C:\Users\admin\AppData\Local\Temp\quickmac.exe" C:\Users\admin\AppData\Local\Temp\quickmac.exe
explorer.exe
User:
admin
Company:
Gintaras Didžgalvis
Integrity Level:
MEDIUM
Description:
Quick Macros Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\quickmac.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5124"C:\Program Files (x86)\Quick Macros 2\qm.exe" vC:\Program Files (x86)\Quick Macros 2\qm.exe—quickmac.tmp
User:
admin
Company:
Gintaras Didzgalvis
Integrity Level:
MEDIUM
Description:
Quick Macros
Exit code:
0
Version:
2.4.12.2
Modules
Images
c:\program files (x86)\quick macros 2\qm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5576"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Quick Macros 2\ver 0x2040C02\qmshex32.dll"C:\Windows\SysWOW64\regsvr32.exe—qm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
2 190
Read events
2 145
Write events
37
Delete events
8

Modification events

(PID) Process:(5576) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C00E2DB5-3AF8-45a6-98CB-73FCDE00AC5C}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(5576) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{C00E2DB5-3AF8-45a6-98CB-73FCDE00AC5C}
Value:
Quick Macros
(PID) Process:(516) qm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GinDi\QM2\Settings
Operation:writeName:Installed version
Value:
33819650
(PID) Process:(6476) quickmac.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Quick Macros
Value:
"C:\Program Files (x86)\Quick Macros 2\qm.exe" S
(PID) Process:(6476) quickmac.tmpKey:HKEY_CURRENT_USER\SOFTWARE\GinDi\QM2\Settings
Operation:writeName:Unicode
Value:
1
(PID) Process:(6476) quickmac.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Quick Macros_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (u)
(PID) Process:(6476) quickmac.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Quick Macros_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\Quick Macros 2
(PID) Process:(6476) quickmac.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Quick Macros_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Quick Macros 2\
(PID) Process:(6476) quickmac.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Quick Macros_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Quick Macros 2
(PID) Process:(6476) quickmac.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Quick Macros_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
63
Suspicious files
27
Text files
326
Unknown types
0

Dropped files

PID
Process
Filename
Type
5072quickmac.exeC:\Users\admin\AppData\Local\Temp\is-11KQT.tmp\quickmac.tmpexecutable
MD5:90FC739C83CD19766ACB562C66A7D0E2
SHA256:821BD11693BF4B4B2B9F3C196036E1F4902ABD95FB26873EA6C43E123B8C9431
6476quickmac.tmpC:\Users\admin\AppData\Local\Temp\is-50O0P.tmp\qmsetup.dllexecutable
MD5:16EA3AB9BC8C76965CFC43F6ABFC16D1
SHA256:83232686FDC18BE40F3E7DE90E080A9C15F8D603C16860317F11B82CCCABF365
904quickmac.exeC:\Users\admin\AppData\Local\Temp\is-DNP11.tmp\quickmac.tmpexecutable
MD5:90FC739C83CD19766ACB562C66A7D0E2
SHA256:821BD11693BF4B4B2B9F3C196036E1F4902ABD95FB26873EA6C43E123B8C9431
6476quickmac.tmpC:\Program Files (x86)\Quick Macros 2\is-A2BEQ.tmpexecutable
MD5:649EE441B2AD576E4ADDF0693852B166
SHA256:3AC388C8A7DEA0A4BE89001A044B99BDCF9DB68D729EFDEA41DA980AB8EA2212
6476quickmac.tmpC:\Users\admin\AppData\Local\Temp\is-50O0P.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6476quickmac.tmpC:\Program Files (x86)\Quick Macros 2\is-MFU99.tmpexecutable
MD5:61CE9DB79EAA2BBFF11DF832B3ED14C7
SHA256:1AFCAC552BFDEA8C645087B369F2F74D10ECC2B2525462799C650DBBCC16D584
6476quickmac.tmpC:\Program Files (x86)\Quick Macros 2\is-UBSIS.tmpexecutable
MD5:CF8753460EF1E880B52697AA275E0667
SHA256:938F62EE14F9F72F321130524E192A4DDC2C8538B2EA5E5B884035F2EA5E5E54
6476quickmac.tmpC:\Program Files (x86)\Quick Macros 2\qmserv.exeexecutable
MD5:CF8753460EF1E880B52697AA275E0667
SHA256:938F62EE14F9F72F321130524E192A4DDC2C8538B2EA5E5B884035F2EA5E5E54
6476quickmac.tmpC:\Program Files (x86)\Quick Macros 2\qm.exeexecutable
MD5:61CE9DB79EAA2BBFF11DF832B3ED14C7
SHA256:1AFCAC552BFDEA8C645087B369F2F74D10ECC2B2525462799C650DBBCC16D584
6476quickmac.tmpC:\Program Files (x86)\Quick Macros 2\unins000.exeexecutable
MD5:649EE441B2AD576E4ADDF0693852B166
SHA256:3AC388C8A7DEA0A4BE89001A044B99BDCF9DB68D729EFDEA41DA980AB8EA2212
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4988
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4988
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4988
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.22
  • 20.190.160.5
  • 20.190.160.131
  • 20.190.160.3
  • 20.190.160.130
  • 20.190.160.67
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
quickmac.exe