File name:

satan.exe

Full analysis: https://app.any.run/tasks/6111a7a0-53bb-4637-b378-eb7ff1574a1f
Verdict: Malicious activity
Analysis date: May 16, 2025, 16:22:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

C9C341EAF04C89933ED28CBC2739D325

SHA1:

C5B7D47AEF3BD33A24293138FCBA3A5FF286C2A8

SHA256:

1A0A2FD546E3C05E15B2DB3B531CB8E8755641F5F1C17910CE2FB7BBCE2A05B7

SSDEEP:

3072:H8SIBtQnE7OhssdWJ5jy392aCmCbBq0ryEbh/Wl7hqU6Q4NJ15xgDbvSY5thfRb3:c7qvhssdu5jyYaCmCQVE6hqUI5sb9Rb3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs injected code in another process

      • cugu.exe (PID: 7448)

    • Application was injected by another process

      • svchost.exe (PID: 4952)
      • UserOOBEBroker.exe (PID: 1248)
      • StartMenuExperienceHost.exe (PID: 1968)
      • sihost.exe (PID: 4984)
      • svchost.exe (PID: 4544)
      • dllhost.exe (PID: 6896)
      • svchost.exe (PID: 6608)
      • RuntimeBroker.exe (PID: 6160)
      • explorer.exe (PID: 5492)
      • RuntimeBroker.exe (PID: 5368)
      • SearchApp.exe (PID: 2924)
      • backgroundTaskHost.exe (PID: 2040)
      • RuntimeBroker.exe (PID: 1036)
      • svchost.exe (PID: 4684)
      • ApplicationFrameHost.exe (PID: 6952)
      • dllhost.exe (PID: 6176)
      • TextInputHost.exe (PID: 6864)
      • RuntimeBroker.exe (PID: 3032)
      • backgroundTaskHost.exe (PID: 3008)
      • RuntimeBroker.exe (PID: 4528)

    • Deletes shadow copies

      • explorer.exe (PID: 5492)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 5492)

    • Connects to the CnC server

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • satan.exe (PID: 7344)

    • Application launched itself

      • satan.exe (PID: 7324)
      • cugu.exe (PID: 7372)
      • cugu.exe (PID: 1164)

    • Starts CMD.EXE for commands execution

      • satan.exe (PID: 7344)

    • Executing commands from a ".bat" file

      • satan.exe (PID: 7344)

    • Block-list domains

      • explorer.exe (PID: 5492)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 5492)

  • INFO

    • Checks supported languages

      • satan.exe (PID: 7324)
      • satan.exe (PID: 7344)
      • cugu.exe (PID: 7372)
      • cugu.exe (PID: 7448)
      • SearchApp.exe (PID: 2924)
      • cugu.exe (PID: 1164)
      • cugu.exe (PID: 4408)

    • Reads the computer name

      • satan.exe (PID: 7344)
      • satan.exe (PID: 7324)
      • cugu.exe (PID: 7372)
      • cugu.exe (PID: 7448)
      • cugu.exe (PID: 1164)
      • cugu.exe (PID: 4408)

    • Reads the machine GUID from the registry

      • satan.exe (PID: 7324)
      • satan.exe (PID: 7344)
      • cugu.exe (PID: 7372)
      • cugu.exe (PID: 7448)
      • cugu.exe (PID: 1164)
      • SearchApp.exe (PID: 2924)
      • cugu.exe (PID: 4408)

    • Creates files or folders in the user directory

      • satan.exe (PID: 7344)

    • Create files in a temporary directory

      • satan.exe (PID: 7344)

    • Manual execution by a user

      • vssadmin.exe (PID: 7596)

    • Checks proxy server information

      • explorer.exe (PID: 5492)

    • Reads the software policy settings

      • SearchApp.exe (PID: 2924)
      • slui.exe (PID: 7704)

    • Process checks computer location settings

      • SearchApp.exe (PID: 2924)

    • Reads security settings of Internet Explorer

      • RuntimeBroker.exe (PID: 5368)
      • Taskmgr.exe (PID: 7256)
      • explorer.exe (PID: 5492)

    • Local mutex for internet shortcut management

      • RuntimeBroker.exe (PID: 5368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:02:23 19:28:24+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 18432
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x13b9
OSVersion: 5.1
ImageVersion: 1
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
36
Malicious processes
5
Suspicious processes
19

Behavior graph

Click at the process to see the details
start satan.exe no specs satan.exe cugu.exe no specs cmd.exe no specs conhost.exe no specs cugu.exe no specs vssadmin.exe no specs conhost.exe no specs sppextcomobj.exe no specs explorer.exe slui.exe taskmgr.exe no specs taskmgr.exe rundll32.exe no specs cugu.exe cugu.exe no specs slui.exe no specs runtimebroker.exe useroobebroker.exe startmenuexperiencehost.exe backgroundtaskhost.exe searchapp.exe backgroundtaskhost.exe runtimebroker.exe runtimebroker.exe svchost.exe svchost.exe svchost.exe sihost.exe runtimebroker.exe runtimebroker.exe dllhost.exe svchost.exe textinputhost.exe dllhost.exe applicationframehost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1036C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\crypt32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1164"C:\Users\admin\AppData\Roaming\Sauwe\cugu.exe" C:\Users\admin\AppData\Roaming\Sauwe\cugu.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\sauwe\cugu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
1248C:\Windows\System32\oobe\UserOOBEBroker.exe -EmbeddingC:\Windows\System32\oobe\UserOOBEBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
User OOBE Broker
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\psapi.dll
c:\windows\system32\windows.storage.dll
c:\windows\system32\wldp.dll
c:\windows\system32\oobe\useroobebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
1968"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
svchost.exe
User:
admin
Integrity Level:
LOW
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\psapi.dll
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2040"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mcaC:\Windows\System32\backgroundTaskHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Background Task Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2924"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\wincorlib.dll
3008"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mcaC:\Windows\System32\backgroundTaskHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Background Task Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3032C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\psapi.dll
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
3100C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3888C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
26 811
Read events
26 395
Write events
410
Delete events
6

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:{DD57EE79-A67A-65F0-C4FE-C3891FCDB02A}
Value:
C:\Users\admin\AppData\Roaming\Sauwe\cugu.exe
(PID) Process:(4984) sihost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy
Operation:writeName:WasEverActivated
Value:
1
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:TraySearchBoxVisible
Value:
1
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:TraySearchBoxVisibleOnAnyMonitor
Value:
1
(PID) Process:(4952) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings
Operation:writeName:QuietHoursTelemetryLastRun
Value:
6966276800000000
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked
Operation:writeName:StartButton
Value:
149
(PID) Process:(1968) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${c6a388c9-afd3-47e2-a46b-29cb43ad4323}$start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current
Operation:writeName:Data
Value:
0200000060ABAECD7EC6DB0100000000434201000A0A00D0140CCA3200CB8C0A0212267B00410039003400310034003200440039002D0032003100350030002D0034003600380037002D0038003600390033002D003100450036003200320036003500390039003900430031007D000012267B00390033004600380044003900390046002D0036003500300041002D0034003100330035002D0038004200340043002D003200460046004100410041003300450046004600340039007D0000E22C01010000
(PID) Process:(2924) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:delete valueName:CachedFeatureString
Value:
(PID) Process:(2924) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:(2924) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsMSACloudSearchEnabled
Value:
0
Executable files
1
Suspicious files
3
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
7344satan.exeC:\Users\admin\AppData\Local\Temp\tmp_1cc8e07c.battext
MD5:2AE2704F855506AE632FB3FC815F71F2
SHA256:E3EB5B5DABDA93AF296CE87C4A4F8DF8ED7AFEC8D925ECAF53EE08C75FF2DEAF
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15image
MD5:666E2DA7AA58BB00CD3CFAE820917649
SHA256:7D8CC9C51A193C088EE072F4F87D27D26402CF84CF51BCF0A9E221DE7C0DD17D
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:E9F42156DC97F0EF7CE94A60F296E1D6
SHA256:AB8916FE82D3A9D9C08330BE3C0070C59C609F4AFEA0831F8CB2868DE3841CFF
7344satan.exeC:\Users\admin\AppData\Roaming\Sauwe\cugu.exeexecutable
MD5:7B6B9D757CD9D4866BD3515C14440DFC
SHA256:DC3114916FA021B6379A88D32F42024A24B7C0DE715513AC1D7D7560C56DECD3
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chromeimage
MD5:D25BE1489F9FF868F37AA5E3978C87D1
SHA256:D360E5EE2B1A00A0052FBA05761FEA4C009963D656BC6D52947FC2D578AFF0E2
7256Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\http___www_ccleaner_com_ccleanerimage
MD5:D936BC59E11E91DAB4096D47FF5CA8D7
SHA256:1A2348734A25E5DE91886BBD400D38ECCAB56157A2BBF86FE2140002769C012B
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdgeimage
MD5:D936BC59E11E91DAB4096D47FF5CA8D7
SHA256:1A2348734A25E5DE91886BBD400D38ECCAB56157A2BBF86FE2140002769C012B
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_helpimage
MD5:83CA11E387A17C26A8F5D961F9C56B17
SHA256:C22FAD60FEB2EFA565E07B0E75C7855F08333B0501956C84D2274E0BEE23C753
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
54
DNS requests
15
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
144.202.70.158:80
http://6pi3jrqjbssfh6gu.onion.pw/g.php
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
5492
explorer.exe
144.202.70.158:80
6pi3jrqjbssfh6gu.onion.pw
AS-CHOOPA
US
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2924
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
720
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
720
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2924
SearchApp.exe
204.79.197.222:443
fp.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
6pi3jrqjbssfh6gu.onion.pw
  • 144.202.70.158
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.73
  • 40.126.31.1
  • 40.126.31.67
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2603:1030:7::106
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO DNS Query to .onion proxy Domain (onion. pw)
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE Zbot POST Request to C2
5492
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE Zbot POST Request to C2
5492
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE Zbot POST Request to C2
5492
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5492
explorer.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
5492
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE Zbot POST Request to C2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
satan.exe