Find similar analyses in TI Lookup
Analysis date (UTC): 29 August 2024, 17:23Analysis environment: Windows 10 Pro, build 19045, x64

ipwho.is

MD5:0D604D1A1F1E108D1B8367564548ABF9
SHA1:346EC2BC63A6F08CA76319094FCEE670BC7FD30D
SHA256:3A363D4ABF43237B96DB642C33278E5DE8CD7DD634CAC000320A9A0335BF5DA6

Analysis result

Threat level:Malicious activity
Full analysis:Analysis ipwho.is Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

No suspicious indicators.

INFO

Reads the computer name

  • identity_helper.exe (PID: 6952)

Reads Environment values

  • identity_helper.exe (PID: 6952)

Checks supported languages

  • identity_helper.exe (PID: 6952)

The process uses the downloaded file

  • iexplore.exe (PID: 6168)

Reads Microsoft Office registry keys

  • msedge.exe (PID: 964)

Application launched itself

  • msedge.exe (PID: 964)

Threats

PIDProcessClassMessage
5720msedge.exePotentially Bad TrafficET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
5720msedge.exePotentially Bad TrafficET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
5720msedge.exePotentially Bad TrafficET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
5720msedge.exePotentially Bad TrafficET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
5720msedge.exePotentially Bad TrafficET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
5720msedge.exePotentially Bad TrafficET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED