File name:

1 (259)

Full analysis: https://app.any.run/tasks/723edb1c-5f6e-405b-91eb-c53eae1cf5d9
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 18:40:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xor-url
delphi
upx
generic
adware
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

5E4C01A346F0D3CBDF02E40F564EB270

SHA1:

214EFE6ECA991B503DA239317CFC604FFBF30223

SHA256:

3746C3E612A190AECDEC1D659BA847D69A2670ECAA7AFAB954AC56C8289BC6A8

SSDEEP:

49152:aySLKJqSa22aJg6RCmKKINMveZ9mEZD5H/7z5nEg786eF43dCtMP/gP1ThrzO6Vg:bUKsSv2aJq2u51H/FA6eFegMP/z6/u7F

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XORed URL has been found (YARA)

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Changes image file execution options

      • 1 (259).exe (PID: 6028)

    • Changes the autorun value in the registry

      • 1 (259).exe (PID: 6028)

    • Actions looks like stealing of personal data

      • 1 (259).exe (PID: 6028)

  • SUSPICIOUS

    • Application launched itself

      • 1 (259).exe (PID: 5364)

    • Reads security settings of Internet Explorer

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • There is functionality for taking screenshot (YARA)

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • There is functionality for communication over UDP network (YARA)

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Executes application which crashes

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Searches for installed software

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Access to an unwanted program domain was detected

      • 1 (259).exe (PID: 6028)

  • INFO

    • Process checks computer location settings

      • 1 (259).exe (PID: 5364)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6388)
      • WerFault.exe (PID: 5972)
      • WerFault.exe (PID: 6032)
      • WerFault.exe (PID: 5392)
      • WerFault.exe (PID: 4188)
      • WerFault.exe (PID: 4068)
      • WerFault.exe (PID: 7036)
      • WerFault.exe (PID: 5228)
      • WerFault.exe (PID: 4892)
      • WerFault.exe (PID: 6972)
      • WerFault.exe (PID: 5960)
      • WerFault.exe (PID: 5892)
      • WerFault.exe (PID: 2908)
      • 1 (259).exe (PID: 6028)

    • UPX packer has been detected

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Compiled with Borland Delphi (YARA)

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Reads the computer name

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Checks supported languages

      • 1 (259).exe (PID: 5364)
      • 1 (259).exe (PID: 6028)

    • Creates files in the program directory

      • 1 (259).exe (PID: 6028)

    • Reads the software policy settings

      • slui.exe (PID: 456)

    • Checks proxy server information

      • 1 (259).exe (PID: 6028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(5364) 1 (259).exe
Decrypted-URLs (2)http://chat.hldnetsupport.com/webim/client.php?locale=en&style=simplicity[DOMAIN1]/help.php[DOMAIN1]/site.php[DOMAIN1]/about.php?date=%install_ts%&try=%task_try%&pas=%task_pops%&tver=%task_ids%&tdate=%task_ts%&ver=%wvers%&bit=%xbit%&uni=310-1http://windowsebonus.com/911.php?nd=%badurl%http://new...
http://windowsebonus.com/911.php?nd=%badurl%http://new-win-driver.comhttp://get-best-updates.comhttp://online-firewall.com72EST1503[DOMAIN1]/BadKey=%acode%msiexecs.exe[DOMAIN3]/block.php?url=%url%&z1=%zsinsttime%&uni=350[DOMAIN3]/info/info.php#aboutemmail
(PID) Process(6028) 1 (259).exe
Decrypted-URLs (2)http://chat.hldnetsupport.com/webim/client.php?locale=en&style=simplicity[DOMAIN1]/help.php[DOMAIN1]/site.php[DOMAIN1]/about.php?date=%install_ts%&try=%task_try%&pas=%task_pops%&tver=%task_ids%&tdate=%task_ts%&ver=%wvers%&bit=%xbit%&uni=310-1http://windowsebonus.com/911.php?nd=%badurl%http://new...
http://windowsebonus.com/911.php?nd=%badurl%http://new-win-driver.comhttp://get-best-updates.comhttp://online-firewall.com72EST1503[DOMAIN1]/BadKey=%acode%msiexecs.exe[DOMAIN3]/block.php?url=%url%&z1=%zsinsttime%&uni=350[DOMAIN3]/info/info.php#aboutemmail
No Malware configuration.

TRiD

.scr | Windows screen saver (46.4)
.dll | Win32 Dynamic Link Library (generic) (23.3)
.exe | Win32 Executable (generic) (15.9)
.exe | Generic Win/DOS Executable (7.1)
.exe | DOS Executable Generic (7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2008:03:15 08:58:07+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 17760
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
32
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 1 (259).exe sppextcomobj.exe no specs slui.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs #XOR-URL 1 (259).exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
632C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5364 -s 1356C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
856C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2268C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2088C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2284C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2284C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2376C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2656C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2064C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\cryptsp.dll
2908C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2568C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3300C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2124C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3300C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 2292C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4068C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6028 -s 844C:\Windows\SysWOW64\WerFault.exe—1 (259).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
47 341
Read events
47 178
Write events
102
Delete events
61

Modification events

(PID) Process:(5892) WerFault.exeKey:\REGISTRY\A\{bedd8f8b-fada-ac32-0527-fb0d0a7342c8}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(5892) WerFault.exeKey:\REGISTRY\A\{bedd8f8b-fada-ac32-0527-fb0d0a7342c8}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(4068) WerFault.exeKey:\REGISTRY\A\{377eafe5-98b2-c631-57ce-f2fc3a97bcaf}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(4068) WerFault.exeKey:\REGISTRY\A\{377eafe5-98b2-c631-57ce-f2fc3a97bcaf}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(6028) 1 (259).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe
Operation:writeName:Debugger
Value:
msiexecs.exe -sb
(PID) Process:(6028) 1 (259).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}
Operation:writeName:Compatibility Flags
Value:
1024
(PID) Process:(6028) 1 (259).exeKey:HKEY_CURRENT_USER\SOFTWARE\A8826B
Operation:writeName:cbagpalgmcjhadeh
Value:
v5;O94K?: N4:4 9=9O LIH> LK;IOHL<IH<Op
(PID) Process:(6028) 1 (259).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:E-Set 2011
Value:
C:\Program Files (x86)\E-Set 2011\e-set.exe
(PID) Process:(6028) 1 (259).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
Operation:writeName:WinNT-A8I 24.03.2025
Value:
(PID) Process:(6028) 1 (259).exeKey:HKEY_CURRENT_USER\SOFTWARE\A8826B
Operation:writeName:dafgdakeoa
Value:
<< <<
Executable files
0
Suspicious files
85
Text files
27
Unknown types
1

Dropped files

PID
Process
Filename
Type
5392WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1 (259).exe_5012d8796ffc5f9628a858866ac27418914696_de33259c_26d2069d-c1c3-4e84-adcd-4a29d64d0715\Report.wer —
MD5:—
SHA256:—
6032WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1 (259).exe_5012d8796ffc5f9628a858866ac27418914696_de33259c_b12ab6bf-7940-4d4f-ac95-70249567f55f\Report.wer —
MD5:—
SHA256:—
6388WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1 (259).exe_5012d8796ffc5f9628a858866ac27418914696_de33259c_79830b34-f5e6-4e02-83ff-37b88489d731\Report.wer —
MD5:—
SHA256:—
5972WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1 (259).exe_5012d8796ffc5f9628a858866ac27418914696_de33259c_858b537a-ce29-4279-8295-0347aea4787b\Report.wer —
MD5:—
SHA256:—
4756WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1 (259).exe_5012d8796ffc5f9628a858866ac27418914696_de33259c_f7db4751-76b9-4e28-95cd-86368ca0aebc\Report.wer —
MD5:—
SHA256:—
5392WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCF67.tmp.dmpbinary
MD5:027D4FFE99248C6C4A2AE5C0955ADB84
SHA256:B15C2674706D3CA355189B4100434EE5B0B98333C95C9F0326655138A0D21A3C
5392WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD44A.tmp.WERInternalMetadata.xmlbinary
MD5:2A651B8F9052E2ACB615A7A2D3294A5E
SHA256:619B7615F486A77D2E8ACCB3DB6E1B3FA3DE0D9C2FBE09AB5E13F4754007E755
6388WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDBEB.tmp.dmpbinary
MD5:E174D5647C9AC6AAAB5158A7B70FF354
SHA256:7E71C05ED36203870B582F3471C1DA25623EFE38326EFA1F8CFFB68BECABF010
5972WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1 (259).exe(3).5364.dmpbinary
MD5:5A7C2156F8DC4B8BE17B070AF00EF15D
SHA256:51A2371E1795E72B6CEF613EFA0151644FC9895E8F25C6FA7B4AAAB1A810BA7C
632WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1 (259).exe_5012d8796ffc5f9628a858866ac27418914696_de33259c_0d6fc062-c8ea-4331-a440-d171cda59f6a\Report.wer —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
27
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.51:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5376
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2772
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2772
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6028
1 (259).exe
GET
301
87.248.119.251:80
http://help.yahoo.com/
unknown
—
—
whitelisted
6028
1 (259).exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.164.51:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.51
  • 2.16.164.17
  • 2.16.164.112
  • 2.16.164.113
  • 2.16.164.65
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.67
  • 20.190.159.73
  • 40.126.31.69
  • 40.126.31.0
  • 40.126.31.1
  • 40.126.31.3
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
new-win-driver.com
  • —
unknown
help.yahoo.com
  • 87.248.119.251
  • 87.248.119.252
whitelisted

Threats

PID
Process
Class
Message
6028
1 (259).exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (Mozilla) - Possible Spyware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (259)