File name:

cprepair.exe

Full analysis: https://app.any.run/tasks/59de9fce-7d3a-4fc4-a31e-a1feff52c61f
Verdict: Malicious activity
Analysis date: March 24, 2025, 12:45:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

A5A6C6C1EDBE87D744D0B148560A6C96

SHA1:

233C88DD8486377178A83547891D350CEF8EFE86

SHA256:

494523B18CBECC73DA06F46A286EA69E61F5A16FABBA55328661190510508770

SSDEEP:

98304:mrq3BdwqpzUmCkOG664nMLi05gOxMPy24nPkviUL/MYjOgHLRd+pybbm/ohniaqC:HTCB2ibhokUNwIaJ/VqcMI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • cprepair.tmp (PID: 4988)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cprepair.tmp (PID: 7148)

    • Executable content was dropped or overwritten

      • cprepair.exe (PID: 4812)
      • cprepair.exe (PID: 4488)
      • cprepair.tmp (PID: 4988)

    • Reads the Windows owner or organization settings

      • cprepair.tmp (PID: 4988)

    • Process drops legitimate windows executable

      • cprepair.tmp (PID: 4988)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 7584)
      • regsvr32.exe (PID: 7624)
      • regsvr32.exe (PID: 7648)
      • regsvr32.exe (PID: 7756)
      • regsvr32.exe (PID: 7780)

  • INFO

    • Create files in a temporary directory

      • cprepair.exe (PID: 4812)
      • cprepair.exe (PID: 4488)
      • cprepair.tmp (PID: 4988)

    • Checks supported languages

      • cprepair.exe (PID: 4812)
      • cprepair.tmp (PID: 7148)
      • cprepair.exe (PID: 4488)
      • cprepair.tmp (PID: 4988)

    • Process checks computer location settings

      • cprepair.tmp (PID: 7148)

    • Reads the computer name

      • cprepair.tmp (PID: 7148)
      • cprepair.exe (PID: 4488)
      • cprepair.tmp (PID: 4988)

    • The sample compiled with spanish language support

      • cprepair.tmp (PID: 4988)

    • The sample compiled with english language support

      • cprepair.tmp (PID: 4988)

    • Creates files or folders in the user directory

      • cprepair.tmp (PID: 4988)
      • BackgroundTransferHost.exe (PID: 4380)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8048)
      • BackgroundTransferHost.exe (PID: 1388)
      • BackgroundTransferHost.exe (PID: 7584)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 4380)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 4380)

    • Detects InnoSetup installer (YARA)

      • cprepair.exe (PID: 4812)
      • cprepair.tmp (PID: 7148)

    • Compiled with Borland Delphi (YARA)

      • cprepair.exe (PID: 4812)
      • cprepair.tmp (PID: 7148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 4.9.0.0
ProductVersionNumber: 4.9.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Consulta Práctica ®
FileDescription: CP Reparaciones Setup
FileVersion: 4.9.0.0
LegalCopyright: Dr. Ignacio Mario Morales Flores
OriginalFileName:
ProductName: CP Reparaciones
ProductVersion: 4.9.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
26
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cprepair.exe cprepair.tmp no specs cprepair.exe cprepair.tmp regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1388"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4380"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4488"C:\Users\admin\AppData\Local\Temp\cprepair.exe" /SPAWNWND=$80296 /NOTIFYWND=$40260 C:\Users\admin\AppData\Local\Temp\cprepair.exe
cprepair.tmp
User:
admin
Company:
Consulta Práctica ®
Integrity Level:
HIGH
Description:
CP Reparaciones Setup
Version:
4.9.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cprepair.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
4812"C:\Users\admin\AppData\Local\Temp\cprepair.exe" C:\Users\admin\AppData\Local\Temp\cprepair.exe
explorer.exe
User:
admin
Company:
Consulta Práctica ®
Integrity Level:
MEDIUM
Description:
CP Reparaciones Setup
Version:
4.9.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cprepair.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
4988"C:\Users\admin\AppData\Local\Temp\is-QIRTD.tmp\cprepair.tmp" /SL5="$902EA,7577705,845824,C:\Users\admin\AppData\Local\Temp\cprepair.exe" /SPAWNWND=$80296 /NOTIFYWND=$40260 C:\Users\admin\AppData\Local\Temp\is-QIRTD.tmp\cprepair.tmp
cprepair.exe
User:
admin
Company:
Consulta Práctica ®
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qirtd.tmp\cprepair.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
7148"C:\Users\admin\AppData\Local\Temp\is-U67OV.tmp\cprepair.tmp" /SL5="$40260,7577705,845824,C:\Users\admin\AppData\Local\Temp\cprepair.exe" C:\Users\admin\AppData\Local\Temp\is-U67OV.tmp\cprepair.tmp—cprepair.exe
User:
admin
Company:
Consulta Práctica ®
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-u67ov.tmp\cprepair.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
7200"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7540"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\msvbvm60.dll"C:\Windows\SysWOW64\regsvr32.exe—cprepair.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7560"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\Comdlg32.ocx"C:\Windows\SysWOW64\regsvr32.exe—cprepair.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7584"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\DBLIST32.OCX"C:\Windows\SysWOW64\regsvr32.exe—cprepair.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
3 245
Read events
2 697
Write events
401
Delete events
147

Modification events

(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\msvbvm60.dll
Value:
2
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\vb6es.dll
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\CMDLGES.DLL
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\SSCALA32.OCX
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\mscmces.dll
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\mscomctl.ocx
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\THREED32.OCX
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\TDBGS32.OCX
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\CPTools.dll
Value:
1
(PID) Process:(4988) cprepair.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:C:\WINDOWS\system32\VBPrnDlg.dll
Value:
1
Executable files
117
Suspicious files
36
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4488cprepair.exeC:\Users\admin\AppData\Local\Temp\is-QIRTD.tmp\cprepair.tmpexecutable
MD5:DCB9361FC1E4AED8DD1539C61658762F
SHA256:DF834164D7CCEEED296128A451656E9819D6F8F338AA7F9D627D7515EC3EF557
4812cprepair.exeC:\Users\admin\AppData\Local\Temp\is-U67OV.tmp\cprepair.tmpexecutable
MD5:DCB9361FC1E4AED8DD1539C61658762F
SHA256:DF834164D7CCEEED296128A451656E9819D6F8F338AA7F9D627D7515EC3EF557
4988cprepair.tmpC:\CPRepair\CPRepair.chmbinary
MD5:E261772F6C1E4AD0298DCC8C5BB331B1
SHA256:4FC890966F16F4998965A37CCA696FE6502196B5AA417A2EC2C19D3316CA0DA6
4988cprepair.tmpC:\CPRepair\Entrada.rptbinary
MD5:25EBAF03C1DAA8565891BFA2D81FA007
SHA256:69CC57FD063E4639E2E5227DF3DF17FF15546A7AB1D0863F96D3FE96A0A0E9CC
4988cprepair.tmpC:\CPRepair\is-5G4ON.tmpbinary
MD5:E261772F6C1E4AD0298DCC8C5BB331B1
SHA256:4FC890966F16F4998965A37CCA696FE6502196B5AA417A2EC2C19D3316CA0DA6
4988cprepair.tmpC:\CPRepair\CPRepair.exeexecutable
MD5:B8DC82198B72C3B6710A9CA950F80E4B
SHA256:FA2BA4D2BE6A09123F677F911BA61590B9C8D23B79CA90A5889FF3D946AB300F
4988cprepair.tmpC:\CPRepair\is-BBG3V.tmpbinary
MD5:83001B5FB560037996A8298A6E69F5F9
SHA256:C079AE846531C1951B471EACAF8C13204100E00664172D8C625C2B61B581290B
4988cprepair.tmpC:\CPRepair\is-OAJGI.tmpbinary
MD5:25EBAF03C1DAA8565891BFA2D81FA007
SHA256:69CC57FD063E4639E2E5227DF3DF17FF15546A7AB1D0863F96D3FE96A0A0E9CC
4988cprepair.tmpC:\CPRepair\EntradaDom.rptbinary
MD5:83001B5FB560037996A8298A6E69F5F9
SHA256:C079AE846531C1951B471EACAF8C13204100E00664172D8C625C2B61B581290B
4988cprepair.tmpC:\CPRepair\is-635I9.tmpbinary
MD5:2CF989E35F6D0682C251DDBB1326271B
SHA256:A8FCC01B90741611C16CAC2083EDF01BF6C9E40C2EAAEFCEDCD1413855B0BF08
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7052
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4380
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1244
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7052
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7052
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.129
  • 40.126.31.130
  • 40.126.31.2
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.0
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
  • 2.23.227.221
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cprepair.exe