File name:

DropCheats.exe

Full analysis: https://app.any.run/tasks/aed200f9-06b2-46d6-bc9d-2e5163dc262e
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: August 14, 2025, 20:33:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
rhadamanthys
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 7 sections
MD5:

6EF1598F4BE9DB05631564FBA23A394E

SHA1:

097611C69A3EBC95021F2C54499FC90DFEAB169D

SHA256:

2B178CCE1CA7CABD3B59ECCE0F73FA78BB889FDB652DE5FC61AEAD23E5AD5AAA

SSDEEP:

49152:0tnvN/tdwR1isQjQ2g34o1kJSJLny+S6wxwwSwJ8eVmJuMWo:SnvN/Tw1Qg34o1KGLyc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • OOBE-Maintenance.exe (PID: 1160)

    • RHADAMANTHYS has been detected (YARA)

      • OOBE-Maintenance.exe (PID: 1160)

  • SUSPICIOUS

    • Connects to unusual port

      • OpenWith.exe (PID: 1336)
      • OOBE-Maintenance.exe (PID: 1160)

    • Executes application which crashes

      • CredentialUIBroker.exe (PID: 6104)

    • The process checks if it is being run in the virtual environment

      • OpenWith.exe (PID: 1336)

    • Multiple wallet extension IDs have been found

      • OOBE-Maintenance.exe (PID: 1160)

    • Reads security settings of Internet Explorer

      • msedge.exe (PID: 6104)

    • Reads Mozilla Firefox installation path

      • msedge.exe (PID: 6104)

    • Loads DLL from Mozilla Firefox

      • OOBE-Maintenance.exe (PID: 1160)

    • Searches for installed software

      • OOBE-Maintenance.exe (PID: 1160)

  • INFO

    • Checks supported languages

      • DropCheats.exe (PID: 2228)
      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)

    • Create files in a temporary directory

      • OOBE-Maintenance.exe (PID: 1160)
      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)

    • Manual execution by a user

      • OpenWith.exe (PID: 1336)
      • OOBE-Maintenance.exe (PID: 1160)

    • Reads the computer name

      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)

    • Application launched itself

      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)

    • Reads Environment values

      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)

    • Reads CPU info

      • chrome.exe (PID: 4744)

    • Checks proxy server information

      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)
      • slui.exe (PID: 6796)

    • Reads the machine GUID from the registry

      • chrome.exe (PID: 4744)
      • msedge.exe (PID: 6104)

    • Process checks whether UAC notifications are on

      • msedge.exe (PID: 6104)

    • Process checks computer location settings

      • msedge.exe (PID: 6104)
      • chrome.exe (PID: 4744)

    • Creates files or folders in the user directory

      • msedge.exe (PID: 6104)

    • Reads the software policy settings

      • slui.exe (PID: 6796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Rhadamanthys

(PID) Process(1160) OOBE-Maintenance.exe
C2 (1)https://srwznongqnbatpxubcqlc.fv/gateway/ka1y74vi.gomsp
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 580096
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0x60940
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
45
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dropcheats.exe no specs credentialuibroker.exe openwith.exe werfault.exe no specs #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,17797395816510691319,4919800886803264281,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3872,i,17797395816510691319,4919800886803264281,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=4388,i,2664555736546212191,11656490284277272697,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
1160"C:\WINDOWS\system32\OOBE-Maintenance.exe"C:\Windows\System32\OOBE-Maintenance.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
OOBE-Maintenance
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\oobe-maintenance.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shcore.dll
Rhadamanthys
(PID) Process(1160) OOBE-Maintenance.exe
C2 (1)https://srwznongqnbatpxubcqlc.fv/gateway/ka1y74vi.gomsp
1336"C:\WINDOWS\system32\openwith.exe"C:\Windows\SysWOW64\OpenWith.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3676,i,17797395816510691319,4919800886803264281,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
1352"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2020,i,17797395816510691319,4919800886803264281,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1980"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3612,i,2664555736546212191,11656490284277272697,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3708,i,17797395816510691319,4919800886803264281,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2228"C:\Users\admin\Downloads\DropCheats.exe" C:\Users\admin\Downloads\DropCheats.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\dropcheats.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
7 073
Read events
7 056
Write events
16
Delete events
1

Modification events

(PID) Process:(4744) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(6212) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6212) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4744) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4744) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings
Operation:delete keyName:(default)
Value:
(PID) Process:(4744) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4744) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(5768) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5768) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6104) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
Executable files
0
Suspicious files
134
Text files
71
Unknown types
110

Dropped files

PID
Process
Filename
Type
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\History-journal —
MD5:—
SHA256:—
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Crashpad\settings.datbinary
MD5:F7389DB595ECB62D6485D87D0B90AD22
SHA256:FE449995BE92411E15285E63B287024245848DD139291EA3C93BAFA129C786BB
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Last Versiontext
MD5:D18CE7F480944AE4E61A969D8C1E5003
SHA256:E0CB362A73D69BAD940A018881701B5F2A8527C13C3F5ACBBEA43B8820DFC199
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\READMEtext
MD5:883D62ACD72005F3AD7A14500D482033
SHA256:C43668EEC4A8D88A5B3A06A84F8846853FE33E54293C2DB56899A5A5DFB4D944
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\Sync Data\LevelDB\MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\Historysqlite
MD5:9B85A4B842B758BE395BC19ABA64799C
SHA256:ECC8D7540D26E3C2C43589C761E94638FC5096AF874D7DF216E833B9599C673A
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\Site Characteristics Database\000001.dbtmptext
MD5:46295CAC801E5D4857D09837238A6394
SHA256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Local Statebinary
MD5:4F7A7D0E57419D6DD6CBE823704B923D
SHA256:33FB28AB7DF684F12CF9BD15F6A6C5C27F35F6BBACF7FEE87E62EF363EB4E4C4
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\Sync Data\LevelDB\000001.dbtmptext
MD5:46295CAC801E5D4857D09837238A6394
SHA256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
4744chrome.exeC:\Users\admin\AppData\Local\Temp\chr1BEA.tmp\Default\Code Cache\wasm\index-dir\the-real-indexbinary
MD5:EFEF91815B0E80625156877C6BA71421
SHA256:F7A6E06A68F826F5C5DF4F70D40162782BF8B1CAF7020B5D481505803072254E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
72
DNS requests
65
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7076
chrome.exe
GET
302
142.250.184.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3396
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5876
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7076
chrome.exe
GET
200
142.250.185.238:80
http://clients2.google.com/time/1/current?cup2key=8:Al6nMJcLajhIr539Ofvh3pWGVzR1SzsmUSijlUFiP_U&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
3840
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:Q3C-xsbnGAvZ0LxOr7a-s8b6N2V-aPG5-4pERkEAO7w&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5876
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6356
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3396
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3396
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1336
OpenWith.exe
104.16.248.249:443
cloudflare-dns.com
CLOUDFLARENET
—
whitelisted
1336
OpenWith.exe
94.26.90.16:1888
—
Deutsche Telekom AG
GB
unknown
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 216.58.212.174
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.131
  • 20.190.159.23
  • 20.190.159.129
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
cloudflare-dns.com
  • 104.16.248.249
  • 104.16.249.249
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.37
  • 23.216.77.30
  • 23.216.77.27
  • 23.216.77.19
  • 23.216.77.13
  • 23.216.77.28
  • 23.216.77.41
  • 23.216.77.29
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 95.101.149.131
whitelisted
x.ns.gin.ntt.net
  • 129.250.35.250
whitelisted
time.apple.com
  • 17.253.52.253
  • 17.253.14.125
  • 17.253.14.253
whitelisted
ntp1.hetzner.de
  • 213.239.239.164
whitelisted

Threats

PID
Process
Class
Message
1336
OpenWith.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 17
1336
OpenWith.exe
Misc activity
ET INFO Cloudflare DNS Over HTTPS Certificate Inbound
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
1160
OOBE-Maintenance.exe
Misc activity
ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chr1BEA.tmp directory exists )
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chr2FE1.tmp directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DropCheats.exe