File name:

301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa

Full analysis: https://app.any.run/tasks/91628d37-dac7-4a20-9c97-8485459ad1c2
Verdict: Malicious activity
Analysis date: August 01, 2025, 02:23:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

E1CF72329542DE8B3004517EE07D8371

SHA1:

C22AC1F279CC11DFFD30A41863181DA598231D4B

SHA256:

301E56052CF570110E66A429C0ACC2454569FF5F966AF0E809BEF33EB2E02BAA

SSDEEP:

49152:yH7Ax9Gv/FNIAn8NlPbaTgQknJpMn3hGhQKiaNg3grAEqX9JEcSqHIRMC1NyXykk:icC9vQlP+TgQkJKnAhHhg3grAES9J7H6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 1356)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 3768)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

    • Reads the Windows owner or organization settings

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

    • Process drops legitimate windows executable

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

    • Starts CMD.EXE for commands execution

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3580)

    • The executable file from the user directory is run by the CMD process

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 3768)

    • The process checks if it is being run in the virtual environment

      • regsvr32.exe (PID: 3976)
      • regsvr32.exe (PID: 3556)
      • regsvr32.exe (PID: 5876)

    • Starts POWERSHELL.EXE for commands execution

      • regsvr32.exe (PID: 3976)
      • regsvr32.exe (PID: 3556)
      • regsvr32.exe (PID: 5876)

    • The process executes via Task Scheduler

      • regsvr32.exe (PID: 3556)
      • updater.exe (PID: 1100)
      • regsvr32.exe (PID: 5876)

    • Connects to unusual port

      • regsvr32.exe (PID: 3976)

    • Application launched itself

      • updater.exe (PID: 1100)

  • INFO

    • Checks supported languages

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 1356)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 3768)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)
      • updater.exe (PID: 1100)
      • updater.exe (PID: 4744)

    • Reads the computer name

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)
      • updater.exe (PID: 1100)

    • Create files in a temporary directory

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 1356)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe (PID: 3768)

    • The sample compiled with english language support

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 2280)
      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

    • Creates a software uninstall entry

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

    • Creates files or folders in the user directory

      • 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp (PID: 7140)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6748)
      • powershell.exe (PID: 1944)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 3760)

    • Checks proxy server information

      • slui.exe (PID: 7156)

    • Reads the software policy settings

      • slui.exe (PID: 7156)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 1100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:05:29 11:51:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 86016
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x16478
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Alert Window Setup
FileVersion:
LegalCopyright:
ProductName: Alert Window
ProductVersion: 10.38.65.1278
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
22
Malicious processes
2
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp cmd.exe no specs conhost.exe no specs timeout.exe no specs 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp regsvr32.exe no specs regsvr32.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs slui.exe regsvr32.exe no specs powershell.exe no specs conhost.exe no specs updater.exe no specs updater.exe no specs regsvr32.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1100"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356"C:\Users\admin\AppData\Local\Temp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe" C:\Users\admin\AppData\Local\Temp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Alert Window Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1944"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\admin\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2124timeout /T 3 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2280"C:\Users\admin\AppData\Local\Temp\is-ROGEJ.tmp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp" /SL5="$7033E,1097818,140800,C:\Users\admin\AppData\Local\Temp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe" C:\Users\admin\AppData\Local\Temp\is-ROGEJ.tmp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp
301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-rogej.tmp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\admin\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2508\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2620"regsvr32.exe" /s /i:INSTALL "C:\Users\admin\AppData\Roaming\\DelightfulCard.dll"C:\Windows\SysWOW64\regsvr32.exe—301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
27 340
Read events
27 310
Write events
24
Delete events
6

Modification events

(PID) Process:(2280) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E8080000D15DFD4A8B02DC01
(PID) Process:(2280) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
713932D3B08B4FF09C8F81A8FCF33F8D7342A87186192877B79C0433EFD76927
(PID) Process:(2280) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
E41B00002B11974C8B02DC01
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
E6F9DE02109355758B8056B9700F51A4B838DF6FE1A3D4BC0A72FBC6AC87D6C7
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Roaming\DelightfulCard.dll
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
917605633C065C0E7BCEEBBE67CDD48131A1708DB1BB5014357869155CC153F8
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alert Window_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.0 (u)
(PID) Process:(7140) 301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alert Window_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local
Executable files
10
Suspicious files
1
Text files
9
Unknown types
1

Dropped files

PID
Process
Filename
Type
3768301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.exeC:\Users\admin\AppData\Local\Temp\is-9ORDK.tmp\301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpexecutable
MD5:14C6FA8E50B4147075EB922BD0C8B28D
SHA256:90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
2280301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Local\Temp\is-V8FBI.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
7140301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Local\Temp\is-U83GT.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
7140301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Local\unins000.datdat
MD5:E16329B92F39778B761338D0B4AB675B
SHA256:BE02B85ABFF9835EFC82AADBE4F340AF91C19AA8535E8806DA9F3E18B05B81CD
7140301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Roaming\is-OQLBE.tmpexecutable
MD5:985FEF2B6872A1A94726DC3B7F1439DE
SHA256:78EF7EACFFABA55E653195FE37846375AEB51B164D80AD312AFDA54163DA0622
7140301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Local\unins000.exeexecutable
MD5:A6837B868F2058E91AAD605F9FDC67C6
SHA256:77C0125A8D22903148B96E6CCB75D955155867D4F66E5A291232F394FEFE6AAE
7140301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Local\Temp\is-U83GT.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
1944powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_le1xebh1.bub.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7140301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa.tmpC:\Users\admin\AppData\Roaming\DelightfulCard.dllexecutable
MD5:985FEF2B6872A1A94726DC3B7F1439DE
SHA256:78EF7EACFFABA55E653195FE37846375AEB51B164D80AD312AFDA54163DA0622
1944powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_01d2rapt.gor.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3540
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3908
SIHClient.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3908
SIHClient.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2216
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3540
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3540
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3976
regsvr32.exe
185.208.159.79:56001
—
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.3.109.244
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.132
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.133
  • 20.190.160.5
  • 40.126.32.72
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
self.events.data.microsoft.com
  • 20.42.73.30
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
301e56052cf570110e66a429c0acc2454569ff5f966af0e809bef33eb2e02baa