File name:

24308529472.zip

Full analysis: https://app.any.run/tasks/4a8e9a19-0dda-47ad-a2da-7cbe7d236f80
Verdict: Malicious activity
Analysis date: February 23, 2026, 03:45:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
nodejs
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

867BB810AFB71D756420F8FE374040A7

SHA1:

FC3260F22AB1A7F5CC5BE0D9D6DC2F6CF0416E47

SHA256:

1D1C4F453CC240BB605BC0A276090A9B9CF9ABDB9BF11FEFD3C4AE8451591989

SSDEEP:

98304:XaQiqigkbt5UOiw8aBm+zbvDkdNsvohbm3uMVFHX8S+l89YeJgcIgUxVaZRQQC3n:i7AUlKkaITE37wKeo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 3628)

    • The process creates files with name similar to system file names

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7992)

    • Creates files or folders in the user directory

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 8308)
      • Food Formula.exe (PID: 3628)
      • Food Formula.exe (PID: 7948)

    • There is functionality for taking screenshot (YARA)

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 9032)

    • Creates a software uninstall entry

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)

    • Reads product name

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 7828)
      • Food Formula.exe (PID: 3628)
      • Food Formula.exe (PID: 5736)

    • Reads Environment values

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 7828)
      • Food Formula.exe (PID: 3628)
      • Food Formula.exe (PID: 5736)

    • Reads the machine GUID from the registry

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 3628)
      • Food Formula.exe (PID: 7948)

    • Drops script file

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 7828)
      • Food Formula.exe (PID: 3628)
      • Food Formula.exe (PID: 5736)

    • Manual execution by a user

      • Food Formula.exe (PID: 9184)
      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 3628)

    • Checks proxy server information

      • Food Formula.exe (PID: 9184)
      • slui.exe (PID: 6320)
      • Food Formula.exe (PID: 3628)

    • Reads the computer name

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 9032)
      • Food Formula.exe (PID: 8308)
      • Food Formula.exe (PID: 3628)
      • Food Formula.exe (PID: 9016)
      • Food Formula.exe (PID: 7204)
      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 7948)

    • Create files in a temporary directory

      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 3628)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7992)

    • Checks supported languages

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 8308)
      • Food Formula.exe (PID: 7828)
      • Food Formula.exe (PID: 9032)
      • Food Formula.exe (PID: 9016)
      • Food Formula.exe (PID: 7204)
      • Food Formula.exe (PID: 3628)
      • b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe (PID: 6796)
      • Food Formula.exe (PID: 7948)
      • Food Formula.exe (PID: 5736)

    • Process checks computer location settings

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 7828)
      • Food Formula.exe (PID: 5736)
      • Food Formula.exe (PID: 3628)

    • Node.js compiler has been detected

      • Food Formula.exe (PID: 9184)
      • Food Formula.exe (PID: 8308)
      • Food Formula.exe (PID: 7828)
      • Food Formula.exe (PID: 9032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xebe3e938
ZipCompressedSize: 7031479
ZipUncompressedSize: 7051328
ZipFileName: b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
12
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe food formula.exe no specs food formula.exe no specs food formula.exe food formula.exe no specs slui.exe food formula.exe no specs food formula.exe no specs food formula.exe food formula.exe no specs food formula.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3628"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe—explorer.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Food Formula
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\rpcrt4.dll
5736"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\food-formula-nativefier-cc6e45" --app-user-model-id=food-formula-nativefier-cc6e45 --app-path="C:\Users\admin\AppData\Roaming\FoodFormula\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2384 --field-trial-handle=1676,i,3021769136450163347,16664531880722766182,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe—Food Formula.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Food Formula
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\roaming\foodformula\ffmpeg.dll
c:\windows\system32\combase.dll
c:\windows\system32\uiautomationcore.dll
6320C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6796"C:\Users\admin\Desktop\b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe" C:\Users\admin\Desktop\b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FormulaSetup
Exit code:
0
Version:
2.6.8.3
Modules
Images
c:\users\admin\desktop\b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7204"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\food-formula-nativefier-cc6e45" --mojo-platform-channel-handle=1700 --field-trial-handle=1676,i,3021769136450163347,16664531880722766182,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe
Food Formula.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Food Formula
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\uiautomationcore.dll
c:\users\admin\appdata\roaming\foodformula\ffmpeg.dll
c:\windows\system32\combase.dll
7828"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\food-formula-nativefier-cc6e45" --app-user-model-id=food-formula-nativefier-cc6e45 --app-path="C:\Users\admin\AppData\Roaming\FoodFormula\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2412 --field-trial-handle=1704,i,5201112089210864927,11932464796923358160,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe—Food Formula.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Food Formula
Exit code:
0
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\users\admin\appdata\roaming\foodformula\ffmpeg.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7948"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --user-data-dir="C:\Users\admin\AppData\Roaming\food-formula-nativefier-cc6e45" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2500 --field-trial-handle=1676,i,3021769136450163347,16664531880722766182,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe—Food Formula.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Food Formula
Exit code:
0
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\appdata\roaming\foodformula\ffmpeg.dll
7992"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\24308529472.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
8308"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\food-formula-nativefier-cc6e45" --mojo-platform-channel-handle=1668 --field-trial-handle=1704,i,5201112089210864927,11932464796923358160,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe
Food Formula.exe
User:
admin
Company:
Jia Hao
Integrity Level:
MEDIUM
Description:
Food Formula
Exit code:
0
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
9016"C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\food-formula-nativefier-cc6e45" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1676,i,3021769136450163347,16664531880722766182,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe—Food Formula.exe
User:
admin
Company:
Jia Hao
Integrity Level:
LOW
Description:
Food Formula
Version:
2.6.8.3
Modules
Images
c:\users\admin\appdata\roaming\foodformula\food formula.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
Total events
15 807
Read events
15 748
Write events
23
Delete events
36

Modification events

(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\24308529472.zip
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
1
Suspicious files
0
Text files
3
Unknown types
154

Dropped files

PID
Process
Filename
Type
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Roaming\FoodFormula\formulas.zip —
MD5:—
SHA256:—
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Roaming\FoodFormula\Food Formula.exe —
MD5:—
SHA256:—
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Roaming\FoodFormula\icudtl.dat —
MD5:—
SHA256:—
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Roaming\FoodFormula\LICENSES.chromium.html —
MD5:—
SHA256:—
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Local\Temp\nsl8E65.tmp\nsDialogs.dllbinary
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Local\Temp\nsl8E65.tmp\NScurl.dllbinary
MD5:22A84B82B3CC522E426A12B1F47FFEB8
SHA256:618BFD44228132C037D5F607D16AD2BE0CBA238824AC3A366DD602BF93BD464E
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Local\Temp\nsl8E65.tmp\math.dllbinary
MD5:180E3D5A7BBA737C402C9A1B86BFCE2A
SHA256:DFD1251DA5DA673223FC362F9EA82F9F536EF04C95C70435B7D5A1B7B9106396
7992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7992.45207\b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53executable
MD5:E0817B5012726EFCC854BB396259823C
SHA256:B179BEC73EFE194BFFB69EEEDC8C136B5E7506A10B3589D223B1E6F8A8FBFB53
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Local\Temp\nsl8E65.tmp\pAnnII6ZeDwhYdcEmIuYPbOgZB2A8AuVp6JDIEJd.tmpbinary
MD5:FC31B34EB1F36E5FF23BE7F4621AA04E
SHA256:BE7A52D6D1B2E5E2C7A9E338F3AB71B4B2E76797F19CC06D5899AECE2701365B
6796b179bec73efe194bffb69eeedc8c136b5e7506a10b3589d223b1e6f8a8fbfb53.exeC:\Users\admin\AppData\Local\Temp\nsl8E65.tmp\System.dllbinary
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
63
TCP/UDP connections
45
DNS requests
29
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7244
svchost.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
7776
SIHClient.exe
GET
304
135.233.95.144:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7776
SIHClient.exe
GET
200
135.233.95.135:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
7776
SIHClient.exe
GET
200
135.233.95.144:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
7776
SIHClient.exe
GET
304
135.233.95.144:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7244
svchost.exe
GET
200
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
binary
5.70 Kb
whitelisted
356
svchost.exe
POST
200
20.190.160.4:443
https://login.live.com/RST2.srf
US
binary
10.3 Kb
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/FlightSettings/FSService?ProcessorClockSpeed=3094&IsRetailOS=1&OEMManufacturerName=DELL&FlightingPolicyValue=3&EnablePreviewBuilds=4294967295&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&ManagePreviewBuilds=3&BranchReadinessLevelSource=0&AttrDataVer=186&ProcessorCores=6&BranchReadinessLevelRaw=16&TotalPhysicalRAM=6144&TPMVersion=0&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&DeviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&App=FSS&AppVer=10.0&SmartActiveHoursState=1&ActiveHoursStart=20&SecureBootCapable=0&ActiveHoursEnd=13&DeviceFamily=Windows.Desktop
US
text
87.3 Kb
whitelisted
5568
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
314 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7244
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8692
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7244
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7244
svchost.exe
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7244
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
3412
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 20.73.194.208
whitelisted
self.events.data.microsoft.com
  • 20.189.173.7
  • 52.168.117.169
whitelisted
google.com
  • 142.251.127.139
  • 142.251.127.101
  • 142.251.127.138
  • 142.251.127.113
  • 142.251.127.100
  • 142.251.127.102
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.181.212
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.2
  • 20.190.160.66
  • 20.190.160.3
  • 20.190.160.131
  • 40.126.32.138
  • 20.190.160.64
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
formulas.foodformulasetup.com
  • 104.26.4.123
  • 104.26.5.123
  • 172.67.73.218
unknown
slscr.update.microsoft.com
  • 135.233.95.144
whitelisted

Threats

PID
Process
Class
Message
7244
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
24308529472.zip