File name:

_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe

Full analysis: https://app.any.run/tasks/8a947f35-d279-4b14-aa54-68386ad21344
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: January 27, 2026, 10:57:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
neoreklami
adware
auto-sch
xor-url
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

2498BDDA9B54A4E6CBB5BE9A2598094B

SHA1:

F88F06099F6F48611AE15308285A0727CB9DCACE

SHA256:

2ACDCE8E5D9D0F63DD4E6D8FDD50518694B0B3D37D0A3E53078245EDC8054150

SSDEEP:

98304:WhUhnNesngLNy6d//Sry/MqXaXARpwGkhRc4s+n54i74ljU2l38fAdb0k3vRGix2:wQigwaMYmkll

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NEOREKLAMI has been detected

      • config.exe (PID: 4924)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4696)
      • powershell.exe (PID: 5772)
      • powershell.exe (PID: 2844)

    • Uses WMIC.EXE to add exclusions to the Windows Defender

      • powershell.exe (PID: 4696)
      • powershell.exe (PID: 5772)
      • powershell.exe (PID: 2844)

    • XORed URL has been found (YARA)

      • config.exe (PID: 4924)

    • NEOREKLAMI mutex has been found

      • config.exe (PID: 4924)

    • Steals credentials from Web Browsers

      • config.exe (PID: 4924)

    • Modifies files in the Chrome extension folder

      • config.exe (PID: 4924)

    • Actions looks like stealing of personal data

      • config.exe (PID: 4924)

    • Uses Task Scheduler to run other applications

      • config.exe (PID: 4924)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • _2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe (PID: 3348)

    • Found strings related to reading or modifying Windows Defender settings

      • config.exe (PID: 4924)
      • forfiles.exe (PID: 7272)
      • forfiles.exe (PID: 8640)
      • forfiles.exe (PID: 3020)

    • Starts CMD.EXE for commands execution

      • config.exe (PID: 4924)
      • forfiles.exe (PID: 7272)
      • forfiles.exe (PID: 8640)
      • forfiles.exe (PID: 3020)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 1348)

    • Searches and executes a command on selected files

      • forfiles.exe (PID: 7272)
      • forfiles.exe (PID: 8640)
      • forfiles.exe (PID: 3020)

    • Reads the BIOS version

      • config.exe (PID: 4924)

    • Executable content was dropped or overwritten

      • _2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe (PID: 3348)
      • config.exe (PID: 4924)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6036)

  • INFO

    • Create files in a temporary directory

      • Install.exe (PID: 1036)
      • _2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe (PID: 3348)
      • config.exe (PID: 4924)

    • Checks supported languages

      • _2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe (PID: 3348)
      • Install.exe (PID: 1036)
      • config.exe (PID: 4924)

    • The sample compiled with english language support

      • _2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe (PID: 3348)

    • Reads security settings of Internet Explorer

      • config.exe (PID: 4924)
      • WMIC.exe (PID: 4100)
      • WMIC.exe (PID: 5628)
      • WMIC.exe (PID: 2392)

    • Process checks computer location settings

      • config.exe (PID: 4924)

    • Reads the computer name

      • config.exe (PID: 4924)

    • Drops script file

      • powershell.exe (PID: 4696)
      • powershell.exe (PID: 5772)
      • powershell.exe (PID: 2844)
      • config.exe (PID: 4924)

    • Launching a file from Task Scheduler

      • config.exe (PID: 4924)

    • There is functionality for taking screenshot (YARA)

      • config.exe (PID: 4924)

    • Creates files or folders in the user directory

      • config.exe (PID: 4924)

    • Checks proxy server information

      • config.exe (PID: 4924)
      • slui.exe (PID: 7544)

    • Reads the machine GUID from the registry

      • config.exe (PID: 4924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(4924) config.exe
Decrypted-URLs (25)http://api.rq-rp.com
http://api.rq-rp.comy
http://helsinki-dtc.com/clrls/cl_rls.json
http://helsinki-dtc.com/updates/yd/wrtzr_yt_a_1/win/update_e.jpg
http://helsinki-dtc.com/updates/yd/wrtzr_yt_a_1/win/version.txt
http://skrptfiles.trace-monitors.com/clrls/cl_rls.json
http://skrptfiles.trace-monitors.com/updates/yd/wrtzr_yt_a_1/win/update_e.jpg
http://skrptfiles.trace-monitors.com/updates/yd/wrtzr_yt_a_1/win/version.txt
http://www.rapidfilestorage.com/clrls/cl_rls.json
http://www.rapidfilestorage.com/updates/yd/wrtzr_yt_a_1/win/update_e.jpg
http://www.rapidfilestorage.com/updates/yd/wrtzr_yt_a_1/win/version.txt
https://api.fetch-api.com
https://api.fetch-api.comr
https://rmtexts.fetch-api.com/google_ifi_ico.png]
https://service-domain.xyz/google_ifi_ico.png[
https://www.google.com/?h=15gfigoky0yidmgsfz0cpzkop82pv1d1kzup.prvyl0ii0
https://www.google.com/?h=42f6od641m7cwdq4el5np41md1zngfir9863.02nfw3obl
https://www.google.com/?h=42f6od641m7cwdq4el5np41md1zngfir9863.02nfw3obl?
https://www.google.com/?h=4py6y4f63yomtkzthf0vliiw5g06q3fhp9h1.0uf38fx1b
https://www.google.com/?h=52x06k33mh5cdi7ed0pyobzborkaow6nxksq.5d15mfc0i
https://www.google.com/?h=6p0jxxs43obizbc14pxs8ve46mfh1fgyfomh.nhh4pjxu8a
https://www.google.com/?h=deq16e06s1blnmuorvzzwr035pdx0vgooxkb.1xvwvg4juL
https://www.google.com/?h=jn87cg3z0mxll39u6m2q14cpn3hyrwgfklei.1qt1kyvk5
https://www.google.com/?h=jsdiq8xf7ic5mw4o3u4js81nub9a52b7im0k.bg7lsc44a
https://www.google.com/?h=md8vgx0vjeebrt7ncv.3510wvesh25r9mbx8d
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 16:27:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 104960
InitializedDataSize: 45568
UninitializedDataSize: -
EntryPoint: 0x14b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.20.0.0
ProductVersionNumber: 9.20.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX
FileVersion: 9.2
InternalName: 7zS.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFileName: 7zS.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.2
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
28
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start _2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe install.exe no specs #NEOREKLAMI config.exe cmd.exe no specs conhost.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs schtasks.exe no specs conhost.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036.\Install.exe C:\Users\admin\AppData\Local\Temp\7zS5030.tmp\Install.exe—_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\7zs5030.tmp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
1348/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=TrueC:\Windows\SysWOW64\cmd.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2392"C:\WINDOWS\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=TrueC:\Windows\SysWOW64\wbem\WMIC.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749889
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
2428"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True" &C:\Windows\SysWOW64\cmd.exe—config.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2844powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=TrueC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
3020forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True" C:\Windows\SysWOW64\forfiles.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ForFiles - Executes a command on selected files
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\forfiles.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3348"C:\Users\admin\Desktop\_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe" C:\Users\admin\Desktop\_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z Setup SFX
Version:
9.20
Modules
Images
c:\users\admin\desktop\_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4100"C:\WINDOWS\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=TrueC:\Windows\SysWOW64\wbem\WMIC.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749889
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
4144schtasks /CREATE /TN "bClEobgEPiqggLXqDh" /SC once /ST 05:58:00 /RU "SYSTEM" /TR "\"C:\Users\admin\AppData\Local\Temp\nkShHarizPJirDEmK\rHKtMEEmTOhcsym\HnVNccH.exe\" GJ /oldidg 452799 /S" /V1 /FC:\Windows\SysWOW64\schtasks.exe—config.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
12 609
Read events
12 608
Write events
1
Delete events
0

Modification events

(PID) Process:(4924) config.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
3
Suspicious files
16
Text files
154
Unknown types
0

Dropped files

PID
Process
Filename
Type
3348_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exeC:\Users\admin\AppData\Local\Temp\7zS5030.tmp\config.exe —
MD5:—
SHA256:—
4924config.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\browser\omni.ja.bak —
MD5:—
SHA256:—
4696powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_edhxoihs.qmq.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4924config.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\browser\omni.ja —
MD5:—
SHA256:—
5772powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ppsesb5u.zig.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3348_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exeC:\Users\admin\AppData\Local\Temp\7zS5030.tmp\Install.exeexecutable
MD5:AAC5B57C87A31DBEC297E750854B719C
SHA256:3C48C74E71CDBC8C1551C938FB53C5710020EF8CD4A371D2944E6CD46FA9F79D
3348_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exeC:\Users\admin\AppData\Local\Temp\7zS5030.tmp\__data__\config.txtbinary
MD5:C3A78A20A2E2B74E02A7FE096175FDFD
SHA256:FF2536808A2EAB69F3A06A393BD4A45D7BBDDFC7CD648D1CF215E1BBF23671F5
4924config.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\permissions.sqlite-journalbinary
MD5:8B2B18C94C37DFA5A70F3C7FFE329598
SHA256:9E7FA3617E20CCCFC3F007E5BC0CA3101E83DE369FCF98FA1430FCA4FD858DC4
4924config.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\permissions.sqlitebinary
MD5:3A84DE207B538230BADB0B072FEAA875
SHA256:FCC000FC49964DE7CFD14DF82A6B989A9B59F835464241CA59FA612EEFEDE268
4696powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:B968829360B4075AF689B257F31F40BC
SHA256:534C0D181BAB12A4D1106F081BEBE652DA523A2E869962CEC155E7320DFFF43B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
53
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7552
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7552
SIHClient.exe
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
7552
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
7552
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7552
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
8356
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
—
7552
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
US
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
95.101.136.194:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8356
svchost.exe
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8356
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6712
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 95.101.136.194
  • 95.101.136.201
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.23
  • 40.126.31.1
  • 40.126.31.71
  • 20.190.159.129
  • 40.126.31.67
  • 40.126.31.130
  • 20.190.159.130
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.128
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.129
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING Request to .XYZ Domain with Minimal Headers
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP Win32/Adware.Neoreklami.MI Activity M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_2acdce8e5d9d0f63dd4e6d8fdd50518694b0b3d37d0a3e53078245edc8054150.exe