File name:

3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50

Full analysis: https://app.any.run/tasks/e5e6ef01-4b4a-4302-866b-25f59fdd3299
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 08:46:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
smoke
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E538A13D55D116777C2766732B2511C2

SHA1:

45FEAFDB23B355D9E1530B16E7C1BC819997FF3F

SHA256:

3982986EBC039AB0E704C819D657C2D1014109B45AA86F058C81FF04771DCB50

SSDEEP:

49152:dLnemIfB6yx6BR4klT6WWbZ/P6zhfgH+2tD4zvsTu2XIc7dxID7ItwCzjty5ln5h:5n2fBeBR4klTtklP6zhoeUD4z2uQx7vz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • 3Ae31eW.exe (PID: 7404)

    • AMADEY mutex has been found

      • explothe.exe (PID: 7828)
      • explothe.exe (PID: 4112)

    • Changes the autorun value in the registry

      • explothe.exe (PID: 7828)

    • Uses Task Scheduler to run other applications

      • explothe.exe (PID: 7828)

    • SMOKE mutex has been found

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe (PID: 4756)
      • pm3tI77.exe (PID: 1532)
      • Tc2Tv02.exe (PID: 7184)
      • vX3Ub30.exe (PID: 7204)
      • Xx5Al47.exe (PID: 5576)

    • Process drops legitimate windows executable

      • pm3tI77.exe (PID: 1532)
      • Xx5Al47.exe (PID: 5576)
      • 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe (PID: 4756)
      • Tc2Tv02.exe (PID: 7184)

    • Executable content was dropped or overwritten

      • pm3tI77.exe (PID: 1532)
      • 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe (PID: 4756)
      • vX3Ub30.exe (PID: 7204)
      • Xx5Al47.exe (PID: 5576)
      • Tc2Tv02.exe (PID: 7184)
      • 5cE6AQ6.exe (PID: 7760)

    • Reads security settings of Internet Explorer

      • 5cE6AQ6.exe (PID: 7760)
      • explothe.exe (PID: 7828)

    • Starts itself from another location

      • 5cE6AQ6.exe (PID: 7760)

    • Starts CMD.EXE for commands execution

      • explothe.exe (PID: 7828)
      • cmd.exe (PID: 7940)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7940)

    • Application launched itself

      • cmd.exe (PID: 7940)

    • Connects to unusual port

      • AppLaunch.exe (PID: 7740)

    • The process executes via Task Scheduler

      • explothe.exe (PID: 4112)

  • INFO

    • The sample compiled with english language support

      • 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe (PID: 4756)
      • pm3tI77.exe (PID: 1532)
      • Xx5Al47.exe (PID: 5576)
      • Tc2Tv02.exe (PID: 7184)

    • Create files in a temporary directory

      • 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe (PID: 4756)
      • Xx5Al47.exe (PID: 5576)
      • pm3tI77.exe (PID: 1532)
      • vX3Ub30.exe (PID: 7204)
      • 5cE6AQ6.exe (PID: 7760)
      • Tc2Tv02.exe (PID: 7184)

    • Checks supported languages

      • pm3tI77.exe (PID: 1532)
      • 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe (PID: 4756)
      • Xx5Al47.exe (PID: 5576)
      • vX3Ub30.exe (PID: 7204)
      • 1IW46gn6.exe (PID: 7228)
      • AppLaunch.exe (PID: 7384)
      • Tc2Tv02.exe (PID: 7184)
      • 3Ae31eW.exe (PID: 7404)
      • AppLaunch.exe (PID: 7248)
      • AppLaunch.exe (PID: 7740)
      • 2As3808.exe (PID: 7260)
      • 4aZ388yB.exe (PID: 7708)
      • explothe.exe (PID: 7828)
      • 5cE6AQ6.exe (PID: 7760)
      • 6Ms3RP9.exe (PID: 7844)
      • explothe.exe (PID: 4112)

    • Reads the computer name

      • AppLaunch.exe (PID: 7248)
      • AppLaunch.exe (PID: 7740)
      • 5cE6AQ6.exe (PID: 7760)
      • explothe.exe (PID: 7828)

    • Process checks computer location settings

      • 5cE6AQ6.exe (PID: 7760)
      • explothe.exe (PID: 7828)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 7740)

    • Checks proxy server information

      • explothe.exe (PID: 7828)
      • explorer.exe (PID: 5492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1442304
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
29
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe pm3ti77.exe xx5al47.exe tc2tv02.exe vx3ub30.exe 1iw46gn6.exe no specs applaunch.exe no specs 2as3808.exe no specs applaunch.exe no specs 3ae31ew.exe no specs sppextcomobj.exe no specs slui.exe no specs 4az388yb.exe no specs applaunch.exe 5ce6aq6.exe explothe.exe 6ms3rp9.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs explothe.exe no specs #SMOKE explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1532C:\Users\admin\AppData\Local\Temp\IXP000.TMP\pm3tI77.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pm3tI77.exe
3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\pm3ti77.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4112"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fefffe8cea\explothe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4756"C:\Users\admin\AppData\Local\Temp\3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe" C:\Users\admin\AppData\Local\Temp\3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5492C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
5576C:\Users\admin\AppData\Local\Temp\IXP001.TMP\Xx5Al47.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Xx5Al47.exe
pm3tI77.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\xx5al47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7184C:\Users\admin\AppData\Local\Temp\IXP002.TMP\Tc2Tv02.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\Tc2Tv02.exe
Xx5Al47.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\tc2tv02.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7204C:\Users\admin\AppData\Local\Temp\IXP003.TMP\vX3Ub30.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\vX3Ub30.exe
Tc2Tv02.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\vx3ub30.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7228C:\Users\admin\AppData\Local\Temp\IXP004.TMP\1IW46gn6.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\1IW46gn6.exe—vX3Ub30.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp004.tmp\1iw46gn6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7248"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—1IW46gn6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7260C:\Users\admin\AppData\Local\Temp\IXP004.TMP\2As3808.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\2As3808.exe—vX3Ub30.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp004.tmp\2as3808.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
3 306
Read events
3 302
Write events
4
Delete events
0

Modification events

(PID) Process:(7828) explothe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\fefffe8cea\
(PID) Process:(7828) explothe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7828) explothe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7828) explothe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
11
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
47563982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\6Ms3RP9.exeexecutable
MD5:7AFCA88F36E14EB409A31AE80B23C4DB
SHA256:64902DFB9F2153AF88F8338E28F062B9E4BF00CABF1BE74AD61FA55ACC7B18A5
1532pm3tI77.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\5cE6AQ6.exeexecutable
MD5:8C5B20B7B925B5010FF099A8F14BE977
SHA256:95F2057627D55036471D52B479E64F494CF99BC9168E91AC76E1781A0867F151
7184Tc2Tv02.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\3Ae31eW.exeexecutable
MD5:D435ED09749D875EAC51BA2EAD9579B4
SHA256:94056E0014926FE2A871C2CE125F4614D7FB6A151159A32CE62DC82740FF32CA
7184Tc2Tv02.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\vX3Ub30.exeexecutable
MD5:AF6FAEBEE4CF570547B86A7B8374BF8D
SHA256:D052AE19979C38FB89BA7207EACD866B09E47874990A95F71740E0376B48EE84
5576Xx5Al47.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\4aZ388yB.exeexecutable
MD5:F389A95EAF41B58B52ACEF421724C412
SHA256:039F721F6913E643A1598C04A466272618C4F85F5279B23EB894B74B6F007129
5576Xx5Al47.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\Tc2Tv02.exeexecutable
MD5:755030318715EAF608EBE9BF23E56A3B
SHA256:F3135CF753DE6F98EBC018879B019C562A867F43F4768005F11AD36F3DE87AE5
1532pm3tI77.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Xx5Al47.exeexecutable
MD5:40E24AC74CD70DBB7EA62835416403BF
SHA256:7668AACF343F0DC016F3283F4A8092E2EDD78108E7004F39C628DD1C4555003A
47563982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pm3tI77.exeexecutable
MD5:E1BBC50C7C530830D3AEA1F945B0841A
SHA256:29999D4F215E8F98E45450D1EFBF302E4F4952D94D5D870A80EBE9EC6C1F05C5
7204vX3Ub30.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\1IW46gn6.exeexecutable
MD5:5849AA2028AE2370B3491595D3A76333
SHA256:FE539814C19C515CC961D0A61BD871AA8204ABAF41BDB419BFD9019B49E71FE2
7204vX3Ub30.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\2As3808.exeexecutable
MD5:029A09BC8B134448DCC8396D88113F31
SHA256:0109476ED419527083695CB964FD1FBFF599D526B0A469A84734DA616CE7F964
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
34
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1280
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1280
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.25
  • 23.216.77.18
  • 23.216.77.15
  • 23.216.77.19
  • 23.216.77.6
  • 23.216.77.22
  • 23.216.77.8
  • 23.216.77.30
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.66
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50