download:

/BingWallPaperClientTest/2.0.1.4/BWCStartMSI.exe

Full analysis: https://app.any.run/tasks/a1252ffb-3853-475d-89d3-b2777f975737
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: January 15, 2025, 13:21:30
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
stealer
redline
confuser
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

89D75B7846DB98111BE948830F9CF7C2

SHA1:

3771CBE04980AF3CDCA295DF79346456D1207051

SHA256:

1077F5FF5FC1C7B7CE347323D14BA387F43E9CFAB9808FA31A1CD3144FA05EF4

SSDEEP:

98304:An2E9XCwijxb+tbaIAXde7t2baQ7W/6wZZQE0gy2rUEEiQsfCnIZ+04WUmcduzJa:StK06s3fyMba6rirohmVQIgG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been found (auto)

      • BWCStartMSI.exe (PID: 6656)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 6788)

    • Actions looks like stealing of personal data

      • BingWallpaperApp.exe (PID: 6648)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BWCStartMSI.exe (PID: 6656)
      • rundll32.exe (PID: 6336)
      • rundll32.exe (PID: 6300)
      • BingWallpaperApp.exe (PID: 6648)

    • Process drops legitimate windows executable

      • BWCStartMSI.exe (PID: 6656)
      • msiexec.exe (PID: 6788)

    • Starts a Microsoft application from unusual location

      • BWCStartMSI.exe (PID: 6656)
      • BWCStartMSI.exe (PID: 6688)

    • Reads security settings of Internet Explorer

      • BWCStartMSI.exe (PID: 6688)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6788)

    • Changes the desktop background image

      • BingWallpaperApp.exe (PID: 6648)

    • Reads Mozilla Firefox installation path

      • BingWallpaperApp.exe (PID: 6648)

  • INFO

    • Checks supported languages

      • BWCStartMSI.exe (PID: 6656)
      • BWCStartMSI.exe (PID: 6688)
      • msiexec.exe (PID: 6788)
      • msiexec.exe (PID: 2484)
      • BingWallpaperApp.exe (PID: 6648)

    • The sample compiled with english language support

      • BWCStartMSI.exe (PID: 6656)
      • rundll32.exe (PID: 6300)
      • rundll32.exe (PID: 6336)
      • BingWallpaperApp.exe (PID: 6648)

    • Reads the computer name

      • BWCStartMSI.exe (PID: 6688)
      • msiexec.exe (PID: 6788)
      • msiexec.exe (PID: 2484)
      • BingWallpaperApp.exe (PID: 6648)

    • Create files in a temporary directory

      • BWCStartMSI.exe (PID: 6656)
      • rundll32.exe (PID: 6336)
      • rundll32.exe (PID: 6300)
      • BingWallpaperApp.exe (PID: 6648)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6788)
      • rundll32.exe (PID: 6300)
      • BingWallpaperApp.exe (PID: 6648)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6788)
      • BingWallpaperApp.exe (PID: 6648)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6788)

    • Reads the software policy settings

      • msiexec.exe (PID: 6788)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6788)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 6336)
      • rundll32.exe (PID: 6300)

    • The process uses the downloaded file

      • rundll32.exe (PID: 6336)

    • Checks proxy server information

      • rundll32.exe (PID: 6300)
      • BingWallpaperApp.exe (PID: 6648)

    • Process checks computer location settings

      • BWCStartMSI.exe (PID: 6688)
      • BingWallpaperApp.exe (PID: 6648)

    • Disables trace logs

      • BingWallpaperApp.exe (PID: 6648)

    • Manual execution by a user

      • Taskmgr.exe (PID: 1580)
      • Taskmgr.exe (PID: 236)

    • Confuser has been detected (YARA)

      • BingWallpaperApp.exe (PID: 6648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2000:11:24 11:50:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.2
CodeSize: 25600
InitializedDataSize: 8506880
UninitializedDataSize: -
EntryPoint: 0x6a00
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.1.4
ProductVersionNumber: 2.0.1.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: BWCStartMSI
FileVersion: 2.0.1.4
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: BWCStartMSI
ProductVersion: 2.0.1.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bwcstartmsi.exe bwcstartmsi.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs rundll32.exe bingwallpaperapp.exe rundll32.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
1580"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
2484C:\Windows\syswow64\MsiExec.exe -Embedding 1AD751D242DC5D186152BAE0E6D26289C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6300rundll32.exe "C:\WINDOWS\Installer\MSI795C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1276281 8 CustomActions!CustomActions.CustomActions.InstallPingC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6336rundll32.exe "C:\WINDOWS\Installer\MSI76AB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1275640 2 CustomActions!CustomActions.CustomActions.StartAppC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6648"C:\Users\admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe" C:\Users\admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Bing Wallpaper
Version:
2.0.1.4
Modules
Images
c:\users\admin\appdata\local\microsoft\bingwallpaperapp\bingwallpaperapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6656"C:\Users\admin\Desktop\BWCStartMSI.exe" C:\Users\admin\Desktop\BWCStartMSI.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BWCStartMSI
Exit code:
0
Version:
2.0.1.4
Modules
Images
c:\users\admin\desktop\bwcstartmsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6688C:\Users\admin\AppData\Local\Temp\IXP000.TMP\BWCStartMSI.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\BWCStartMSI.exe—BWCStartMSI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BWCStartMSI
Exit code:
0
Version:
2.0.1.4
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\bwcstartmsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6756"C:\Windows\System32\msiexec.exe" /q /i BWCInstaller.msi /norestartC:\Windows\SysWOW64\msiexec.exe—BWCStartMSI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6788C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
13 620
Read events
13 481
Write events
129
Delete events
10

Modification events

(PID) Process:(6788) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
841A0000F5DF646C5067DB01
(PID) Process:(6788) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
51278E0F6AA7CE343250A37DFC21235FD9EE2E91A890882E7B72B570A3CB64AF
(PID) Process:(6788) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\136e40.rbs
Value:
31156048
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\136e40.rbsLow
Value:
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E75EB4F5223116D48A5EDF60E49565E9
Operation:writeName:1499D042364BC9B44B38179247B0A91C
Value:
01:\Software\Microsoft\BingWallpaperApp\isMSIInstalled
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\810C749B0985F6E428196CE616BCA73E
Operation:writeName:1499D042364BC9B44B38179247B0A91C
Value:
01:\Software\Microsoft\BingWallpaperApp\isMSIInstalled
(PID) Process:(6788) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\9BC0DD7D0D606B5438AEAEB5EB52DB88
Operation:writeName:1499D042364BC9B44B38179247B0A91C
Value:
01:\Software\Microsoft\BingWallpaperApp\isMSIInstalled
Executable files
13
Suspicious files
25
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
6656BWCStartMSI.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\BWCInstaller.msi —
MD5:—
SHA256:—
6788msiexec.exeC:\Windows\Installer\136e3e.msi —
MD5:—
SHA256:—
6788msiexec.exeC:\Windows\Installer\136e41.msi —
MD5:—
SHA256:—
6788msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:D74F937FF9E54249A4647AB5C44EED1B
SHA256:C98DE8B42D20F4EEFB4499A9D587F73761DDA80F940B2E58F9A404AEA3F0369A
6656BWCStartMSI.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\BWCStartMSI.exeexecutable
MD5:A923912A4643C5502E6C14F423065F11
SHA256:DBE43727DBAA78DDAA08E73562C0FF271444A6C5AE87BA2082A2533157B8FCC4
6788msiexec.exeC:\Windows\Installer\MSI7497.tmpbinary
MD5:681D7B2C4B3DFD928F80AC40D609BEA0
SHA256:A6ECAEE8EA8E96D81F34A7E6EF18472CB3C5E1B6119E8E0E85ED5FFC9DD283AE
6788msiexec.exeC:\Config.Msi\136e40.rbsbinary
MD5:A81DA68C5AF45FB389F3102E9B9851E1
SHA256:5576102CB8EE36915D02C0DEEE9BBB406995ECD26E2776E7E54015EF5AC4F488
6788msiexec.exeC:\Windows\Installer\MSI76AB.tmpexecutable
MD5:917F037636BC8BFD46149CCCBB4E34B5
SHA256:5D98C744D61684418FA69643639A17816422B14F3C95B5A9ED0117CA06147E65
6788msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Installer\{240D9941-B463-4B9C-B483-7129740B9AC1}\favicon.icoimage
MD5:CBC184A5EEA547161A088DE3C9B00112
SHA256:625B51E325133084AEF42A233EF7A11ECE5F36D7A99CF463A2FD1EFA3CF682D7
6788msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:ACF70A82BEB5B4B18E6092B77926F22F
SHA256:C495FEEFBB2E2D126BECE0AED210D3379A408B4206D3BB1531DAA446F515EE72
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
40
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.74:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6788
msiexec.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
6788
msiexec.exe
GET
200
2.16.164.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6300
rundll32.exe
GET
200
20.41.62.11:80
http://g.ceipmsn.com/8SE/44?MI=A2B1304A099FCC44AA1F7189599853B6&LV=10.0.19041.3636&OS=10.0.19045.1&TE=40&TV=isW000%7cpkBingWallpaper%7ctmen-us%7cvr2.0.1.4%7cat1%7crt1%7cpt2
unknown
—
—
unknown
6648
BingWallpaperApp.exe
GET
200
20.41.62.11:80
http://g.ceipmsn.com/8SE/44?MI=A2B1304A099FCC44AA1F7189599853B6&LV=2.0.1.4&OS=10.0.19045.1&TE=40&TV=isW000%7cpkBingWallpaper%7ctmen-us%7cmo%3dMCwxMjgweDcyMA%253D%253D%7cvr2.0.1.4%7cpt6
unknown
—
—
unknown
6488
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6924
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.23.227.199:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.74:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3220
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.227.199
  • 2.23.227.202
  • 2.23.227.221
  • 2.23.227.205
  • 2.23.227.222
  • 2.23.227.215
  • 2.23.227.198
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.164.74
  • 2.16.164.97
  • 2.16.164.88
  • 2.16.164.66
  • 2.16.164.99
  • 2.16.164.83
  • 2.16.164.96
  • 2.16.164.106
  • 2.16.164.72
  • 2.16.164.58
  • 2.16.164.18
  • 2.16.164.82
  • 2.16.164.98
  • 2.16.164.16
  • 2.16.164.34
  • 2.16.164.122
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.4
  • 20.190.159.73
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
g.ceipmsn.com
  • 20.41.62.11
unknown
bingwallpaper.microsoft.com
  • 52.173.134.115
whitelisted
bingwallpaperimages.azureedge.net
  • 13.107.246.45
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/BingWallPaperClientTest/2.0.1.4/BWCStartMSI.exe