File name:

dism_9kD-Ik1.bin

Full analysis: https://app.any.run/tasks/0241219a-ec6d-4c4e-adc7-c15a47f22ba5
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 31, 2024, 03:42:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
installer
adware
innosetup
stealer
netreactor
miner
metastealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4CEF35CB56164E4427C8890CF5CDFD85

SHA1:

242815E66819F32D46C37A57ED707030F57CA2C2

SHA256:

564B8E327A13C948CEA21587245B7B0005F786EA57F62BD602EF4ECEC66171C6

SSDEEP:

98304:b+cD4dno/Kiy69v/P4IzQ0eHJIsm/SK2gyGGnWfA/3nWAs1XnY/QI5QHpsisd:Uz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • dism_9kD-Ik1.bin.exe (PID: 4288)
      • dism_9kD-Ik1.bin.exe (PID: 6412)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • xczfml1m.exe (PID: 7720)
      • UnifiedStub-installer.exe (PID: 7908)

    • INNOSETUP has been detected (SURICATA)

      • dism_9kD-Ik1.bin.tmp (PID: 5812)

    • Actions looks like stealing of personal data

      • UnifiedStub-installer.exe (PID: 7908)
      • rsEngineSvc.exe (PID: 5192)
      • rsVPNSvc.exe (PID: 6412)
      • rsDNSSvc.exe (PID: 7884)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 5028)
      • rundll32.exe (PID: 9032)

    • METASTEALER has been detected (YARA)

      • rsAppUI.exe (PID: 3580)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dism_9kD-Ik1.bin.exe (PID: 4288)
      • dism_9kD-Ik1.bin.exe (PID: 6412)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • xczfml1m.exe (PID: 7720)
      • UnifiedStub-installer.exe (PID: 7908)

    • Reads security settings of Internet Explorer

      • dism_9kD-Ik1.bin.tmp (PID: 2116)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 8120)
      • rsEngineSvc.exe (PID: 7388)
      • rsEDRSvc.exe (PID: 6504)
      • rsEngineSvc.exe (PID: 5192)
      • rsVPNSvc.exe (PID: 5860)
      • rsDNSSvc.exe (PID: 8784)
      • Dism++x64.exe (PID: 8840)

    • Reads the date of Windows installation

      • dism_9kD-Ik1.bin.tmp (PID: 2116)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • rsEDRSvc.exe (PID: 3632)
      • rsEngineSvc.exe (PID: 5192)

    • Reads the Windows owner or organization settings

      • dism_9kD-Ik1.bin.tmp (PID: 5812)

    • Process drops legitimate windows executable

      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • xczfml1m.exe (PID: 7720)
      • UnifiedStub-installer.exe (PID: 7908)
      • WinRAR.exe (PID: 6232)

    • Access to an unwanted program domain was detected

      • dism_9kD-Ik1.bin.tmp (PID: 5812)

    • Executes application which crashes

      • dism_9kD-Ik1.bin.tmp (PID: 5812)

    • Searches for installed software

      • UnifiedStub-installer.exe (PID: 7908)
      • rsVPNSvc.exe (PID: 6412)
      • Dism++x64.exe (PID: 8840)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 8164)
      • rsWSC.exe (PID: 4340)
      • rsClientSvc.exe (PID: 7324)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 3632)
      • WmiApSrv.exe (PID: 7988)
      • rsVPNClientSvc.exe (PID: 7948)
      • rsVPNSvc.exe (PID: 6412)
      • WmiApSrv.exe (PID: 5876)
      • rsDNSClientSvc.exe (PID: 4192)
      • rsDNSResolver.exe (PID: 8688)
      • rsDNSSvc.exe (PID: 7884)
      • WmiApSrv.exe (PID: 6176)

    • Creates a software uninstall entry

      • UnifiedStub-installer.exe (PID: 7908)

    • Drops a system driver (possible attempt to evade defenses)

      • UnifiedStub-installer.exe (PID: 7908)
      • WinRAR.exe (PID: 6232)

    • Drops 7-zip archiver for unpacking

      • UnifiedStub-installer.exe (PID: 7908)

    • The process creates files with name similar to system file names

      • UnifiedStub-installer.exe (PID: 7908)
      • WinRAR.exe (PID: 6232)

    • The process drops C-runtime libraries

      • UnifiedStub-installer.exe (PID: 7908)

    • Creates files in the driver directory

      • UnifiedStub-installer.exe (PID: 7908)

    • Uses RUNDLL32.EXE to load library

      • UnifiedStub-installer.exe (PID: 7908)

    • Creates or modifies Windows services

      • UnifiedStub-installer.exe (PID: 7908)
      • rundll32.exe (PID: 5028)

    • Adds/modifies Windows certificates

      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 8120)
      • rsEngineSvc.exe (PID: 5192)

    • Checks Windows Trust Settings

      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 8120)
      • rsEngineSvc.exe (PID: 7388)
      • rsWSC.exe (PID: 4340)
      • rsEDRSvc.exe (PID: 6504)
      • rsEDRSvc.exe (PID: 3632)
      • rsEngineSvc.exe (PID: 5192)
      • rsVPNSvc.exe (PID: 5860)
      • rsDNSSvc.exe (PID: 8784)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • UnifiedStub-installer.exe (PID: 7908)

    • Dropped object may contain URLs of mainers pools

      • rsEngineSvc.exe (PID: 5192)

    • Reads the BIOS version

      • rsEDRSvc.exe (PID: 3632)
      • rsEngineSvc.exe (PID: 5192)

    • The process checks if it is being run in the virtual environment

      • rsEngineSvc.exe (PID: 5192)
      • rsVPNSvc.exe (PID: 6412)
      • rsDNSSvc.exe (PID: 7884)

    • Process checks is Powershell's Script Block Logging on

      • rsEDRSvc.exe (PID: 3632)

    • Application launched itself

      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 8376)

    • Starts CMD.EXE for commands execution

      • rsDNSSvc.exe (PID: 7884)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 9072)
      • cmd.exe (PID: 8068)

    • There is functionality for taking screenshot (YARA)

      • rsVPNSvc.exe (PID: 6412)

    • Detected use of alternative data streams (AltDS)

      • Dism++x64.exe (PID: 8840)

  • INFO

    • Checks supported languages

      • dism_9kD-Ik1.bin.exe (PID: 4288)
      • dism_9kD-Ik1.bin.tmp (PID: 2116)
      • dism_9kD-Ik1.bin.exe (PID: 6412)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • xczfml1m.exe (PID: 7720)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsSyncSvc.exe (PID: 5068)
      • rsSyncSvc.exe (PID: 8164)
      • identity_helper.exe (PID: 8144)
      • identity_helper.exe (PID: 6224)
      • rsWSC.exe (PID: 8120)
      • rsWSC.exe (PID: 4340)
      • rsClientSvc.exe (PID: 7880)
      • rsClientSvc.exe (PID: 7324)
      • rsEngineSvc.exe (PID: 7388)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 6504)
      • rsHelper.exe (PID: 7256)
      • rsEDRSvc.exe (PID: 3632)
      • EPP.exe (PID: 7892)
      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 704)
      • rsAppUI.exe (PID: 7644)
      • rsAppUI.exe (PID: 7276)
      • rsAppUI.exe (PID: 7592)
      • rsLitmus.A.exe (PID: 5732)
      • rsVPNClientSvc.exe (PID: 7948)
      • rsVPNSvc.exe (PID: 5860)
      • rsVPNSvc.exe (PID: 6412)
      • rsVPNClientSvc.exe (PID: 7508)
      • VPN.exe (PID: 3820)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 1924)
      • rsAppUI.exe (PID: 4660)
      • rsAppUI.exe (PID: 8448)
      • rsAppUI.exe (PID: 7984)
      • Dism++x64.exe (PID: 8840)
      • rsDNSClientSvc.exe (PID: 9188)
      • rsDNSClientSvc.exe (PID: 4192)
      • rsDNSResolver.exe (PID: 8392)
      • rsDNSResolver.exe (PID: 8632)
      • rsDNSResolver.exe (PID: 8688)
      • rsDNSSvc.exe (PID: 8784)
      • rsDNSSvc.exe (PID: 7884)
      • DNS.exe (PID: 7872)
      • rsAppUI.exe (PID: 8376)
      • rsAppUI.exe (PID: 9060)
      • rsAppUI.exe (PID: 8908)
      • rsAppUI.exe (PID: 8940)
      • rsAppUI.exe (PID: 8444)
      • rsAppUI.exe (PID: 3968)

    • Create files in a temporary directory

      • dism_9kD-Ik1.bin.exe (PID: 4288)
      • dism_9kD-Ik1.bin.exe (PID: 6412)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • xczfml1m.exe (PID: 7720)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 8376)

    • Process checks computer location settings

      • dism_9kD-Ik1.bin.tmp (PID: 2116)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • rsAppUI.exe (PID: 7644)
      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 7592)
      • rsVPNSvc.exe (PID: 6412)
      • rsAppUI.exe (PID: 4660)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 8448)
      • rsAppUI.exe (PID: 8908)
      • rsAppUI.exe (PID: 8376)

    • Reads the computer name

      • dism_9kD-Ik1.bin.tmp (PID: 2116)
      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsSyncSvc.exe (PID: 5068)
      • rsSyncSvc.exe (PID: 8164)
      • identity_helper.exe (PID: 8144)
      • identity_helper.exe (PID: 6224)
      • rsWSC.exe (PID: 8120)
      • rsWSC.exe (PID: 4340)
      • rsClientSvc.exe (PID: 7880)
      • rsClientSvc.exe (PID: 7324)
      • rsEngineSvc.exe (PID: 7388)
      • rsEngineSvc.exe (PID: 5192)
      • rsHelper.exe (PID: 7256)
      • rsEDRSvc.exe (PID: 6504)
      • rsEDRSvc.exe (PID: 3632)
      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 704)
      • rsAppUI.exe (PID: 7276)
      • rsVPNClientSvc.exe (PID: 7508)
      • rsVPNClientSvc.exe (PID: 7948)
      • rsVPNSvc.exe (PID: 5860)
      • rsVPNSvc.exe (PID: 6412)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 1924)
      • rsAppUI.exe (PID: 7984)
      • Dism++x64.exe (PID: 8840)
      • rsDNSClientSvc.exe (PID: 9188)
      • rsDNSClientSvc.exe (PID: 4192)
      • rsDNSResolver.exe (PID: 8688)
      • rsDNSResolver.exe (PID: 8632)
      • rsDNSSvc.exe (PID: 8784)
      • rsDNSSvc.exe (PID: 7884)
      • rsAppUI.exe (PID: 8376)
      • rsAppUI.exe (PID: 9060)
      • rsAppUI.exe (PID: 8940)
      • rsAppUI.exe (PID: 8444)
      • rsAppUI.exe (PID: 3968)

    • Reads the software policy settings

      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • WerFault.exe (PID: 5904)
      • UnifiedStub-installer.exe (PID: 7908)
      • WerFault.exe (PID: 4520)
      • slui.exe (PID: 204)
      • rsWSC.exe (PID: 8120)
      • rsEngineSvc.exe (PID: 7388)
      • rsWSC.exe (PID: 4340)
      • rsEDRSvc.exe (PID: 6504)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 3632)
      • rsVPNSvc.exe (PID: 5860)
      • rsVPNSvc.exe (PID: 6412)
      • rsDNSSvc.exe (PID: 7884)
      • rsDNSSvc.exe (PID: 8784)

    • Reads the machine GUID from the registry

      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 8120)
      • rsWSC.exe (PID: 4340)
      • rsEngineSvc.exe (PID: 7388)
      • rsEngineSvc.exe (PID: 5192)
      • rsHelper.exe (PID: 7256)
      • rsEDRSvc.exe (PID: 6504)
      • rsEDRSvc.exe (PID: 3632)
      • rsAppUI.exe (PID: 3580)
      • rsVPNSvc.exe (PID: 5860)
      • rsVPNSvc.exe (PID: 6412)
      • rsAppUI.exe (PID: 320)
      • Dism++x64.exe (PID: 8840)
      • rsDNSSvc.exe (PID: 8784)
      • rsDNSSvc.exe (PID: 7884)
      • rsAppUI.exe (PID: 8376)
      • rsAppUI.exe (PID: 8444)
      • rsAppUI.exe (PID: 3968)

    • Checks proxy server information

      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • prod0.exe (PID: 3968)
      • WerFault.exe (PID: 5904)
      • UnifiedStub-installer.exe (PID: 7908)
      • WerFault.exe (PID: 4520)
      • slui.exe (PID: 204)
      • rsWSC.exe (PID: 8120)
      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 8376)
      • Dism++x64.exe (PID: 8840)

    • Reads Environment values

      • prod0.exe (PID: 3968)
      • UnifiedStub-installer.exe (PID: 7908)
      • identity_helper.exe (PID: 8144)
      • identity_helper.exe (PID: 6224)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 3632)
      • rsAppUI.exe (PID: 3580)
      • rsVPNSvc.exe (PID: 6412)
      • rsAppUI.exe (PID: 320)
      • rsDNSSvc.exe (PID: 7884)
      • rsAppUI.exe (PID: 8376)
      • Dism++x64.exe (PID: 8840)

    • Disables trace logs

      • prod0.exe (PID: 3968)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 3632)
      • rsVPNSvc.exe (PID: 6412)
      • rsDNSSvc.exe (PID: 7884)

    • Reads Microsoft Office registry keys

      • dism_9kD-Ik1.bin.tmp (PID: 5812)
      • msedge.exe (PID: 7076)
      • msedge.exe (PID: 1108)
      • msedge.exe (PID: 3124)

    • Manual execution by a user

      • msedge.exe (PID: 1108)
      • WinRAR.exe (PID: 6232)
      • Dism++x64.exe (PID: 8840)
      • Taskmgr.exe (PID: 6076)
      • Taskmgr.exe (PID: 8036)

    • Application launched itself

      • msedge.exe (PID: 7076)
      • msedge.exe (PID: 1108)
      • msedge.exe (PID: 3124)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5904)
      • WerFault.exe (PID: 4520)
      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 8120)
      • rsEngineSvc.exe (PID: 5192)
      • rsAppUI.exe (PID: 3580)
      • rsAppUI.exe (PID: 7276)
      • rsVPNSvc.exe (PID: 6412)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 1924)
      • rsDNSSvc.exe (PID: 7884)
      • rsAppUI.exe (PID: 8376)
      • rsAppUI.exe (PID: 8940)
      • rsAppUI.exe (PID: 8444)

    • Creates files in the program directory

      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 8120)
      • rsEngineSvc.exe (PID: 7388)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 6504)
      • rsEDRSvc.exe (PID: 3632)
      • rsVPNSvc.exe (PID: 5860)
      • rsVPNSvc.exe (PID: 6412)
      • rsDNSResolver.exe (PID: 8688)
      • rsDNSResolver.exe (PID: 8632)
      • rsDNSSvc.exe (PID: 8784)
      • rsDNSSvc.exe (PID: 7884)

    • .NET Reactor protector has been detected

      • UnifiedStub-installer.exe (PID: 7908)
      • rsWSC.exe (PID: 4340)
      • rsEngineSvc.exe (PID: 5192)
      • rsHelper.exe (PID: 7256)
      • rsEDRSvc.exe (PID: 3632)
      • rsAppUI.exe (PID: 3580)
      • rsVPNSvc.exe (PID: 6412)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 7924)
      • runonce.exe (PID: 9084)
      • Taskmgr.exe (PID: 8036)

    • Reads the time zone

      • runonce.exe (PID: 7924)
      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 3632)
      • rsVPNSvc.exe (PID: 6412)
      • runonce.exe (PID: 9084)
      • rsDNSSvc.exe (PID: 7884)

    • Reads CPU info

      • rsEngineSvc.exe (PID: 5192)
      • rsEDRSvc.exe (PID: 3632)
      • rsVPNSvc.exe (PID: 6412)
      • rsDNSSvc.exe (PID: 7884)

    • Reads product name

      • rsEDRSvc.exe (PID: 3632)
      • rsAppUI.exe (PID: 3580)
      • rsEngineSvc.exe (PID: 5192)
      • rsAppUI.exe (PID: 320)
      • rsAppUI.exe (PID: 8376)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6232)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6232)

    • Process checks whether UAC notifications are on

      • rsEDRSvc.exe (PID: 3632)

    • Checks Windows language

      • Dism++x64.exe (PID: 8840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 2.2.174.2916
ProductVersionNumber: 2.2.174.2916
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription:
FileVersion: 2.2.174.2916
LegalCopyright:
OriginalFileName:
ProductName:
ProductVersion: 2.2.174.2916
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
308
Monitored processes
154
Malicious processes
19
Suspicious processes
3

Behavior graph

Click at the process to see the details
start dism_9kd-ik1.bin.exe dism_9kd-ik1.bin.tmp no specs dism_9kd-ik1.bin.exe #INNOSETUP dism_9kd-ik1.bin.tmp slui.exe prod0.exe winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs werfault.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs xczfml1m.exe THREAT unifiedstub-installer.exe werfault.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs wevtutil.exe no specs conhost.exe no specs fltmc.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs rswsc.exe THREAT rswsc.exe no specs rsclientsvc.exe no specs conhost.exe no specs rsclientsvc.exe no specs rsenginesvc.exe no specs THREAT rsenginesvc.exe rsedrsvc.exe no specs THREAT rshelper.exe no specs THREAT rsedrsvc.exe epp.exe no specs THREAT rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs winrar.exe rslitmus.a.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rsvpnclientsvc.exe no specs conhost.exe no specs rsvpnclientsvc.exe no specs rsvpnsvc.exe no specs THREAT rsvpnsvc.exe vpn.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe rsappui.exe no specs rsappui.exe no specs msedge.exe no specs msedge.exe no specs dism++x64.exe msedge.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs rsdnsclientsvc.exe no specs conhost.exe no specs rsdnsclientsvc.exe no specs rsdnsresolver.exe no specs conhost.exe no specs rsdnsresolver.exe no specs conhost.exe no specs rsdnsresolver.exe no specs rsdnssvc.exe no specs rsdnssvc.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs dns.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe rsappui.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs taskmgr.exe no specs taskmgr.exe msedge.exe no specs msedge.exe no specs rsappui.exe no specs rsappui.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1352 --field-trial-handle=2392,i,7880689794581632208,2507363273127084860,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
204C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=2328,i,15789632730151721905,7526233733536147970,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
320"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\VPN\ui\app.asar" --engine-path="c:\program files\reasonlabs\VPN" --minimized --focused --first-runC:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe—VPN.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
MEDIUM
Description:
ReasonLabs Application
Version:
1.4.2
Modules
Images
c:\program files\reasonlabs\common\client\v1.4.2\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
456ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dhcpcsvc6.dll
528"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6036 --field-trial-handle=2392,i,7880689794581632208,2507363273127084860,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
704"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2284 --field-trial-handle=2288,i,14246901953858439807,12428568275437415957,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
LOW
Description:
ReasonLabs Application
Version:
1.4.2
Modules
Images
c:\program files\reasonlabs\common\client\v1.4.2\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
756"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2780 --field-trial-handle=2328,i,15789632730151721905,7526233733536147970,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
788"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5604 --field-trial-handle=2328,i,15789632730151721905,7526233733536147970,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6804 --field-trial-handle=2392,i,7880689794581632208,2507363273127084860,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
146 229
Read events
145 504
Write events
499
Delete events
226

Modification events

(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
B4160000FC80E4B8FBE2DA01
(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
FE0672F18B7AA31BE3172C605E1078F8E04625F77D5B11CE092C0ECD1A2AC801
(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5812) dism_9kD-Ik1.bin.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3968) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3968) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3968) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
890
Suspicious files
683
Text files
243
Unknown types
61

Dropped files

PID
Process
Filename
Type
4288dism_9kD-Ik1.bin.exeC:\Users\admin\AppData\Local\Temp\is-E669H.tmp\dism_9kD-Ik1.bin.tmpexecutable
MD5:02B1D8FF84BCD4EBCB01156636269B99
SHA256:A6497DDDDD577CAEFE5A39958A604F9EE4BFE93E9DA285B147BA6FC6788E75CA
6412dism_9kD-Ik1.bin.exeC:\Users\admin\AppData\Local\Temp\is-ASO13.tmp\dism_9kD-Ik1.bin.tmpexecutable
MD5:02B1D8FF84BCD4EBCB01156636269B99
SHA256:A6497DDDDD577CAEFE5A39958A604F9EE4BFE93E9DA285B147BA6FC6788E75CA
5812dism_9kD-Ik1.bin.tmpC:\Users\admin\AppData\Local\Temp\is-BNJ7P.tmp\dism.zipcompressed
MD5:86D3F8A73A01FBB6BB985DC9A939FE15
SHA256:9149F635096571CD67A82A2EFA113C819B8B9005E4F29D6F0D6EB26BB15ED41C
5812dism_9kD-Ik1.bin.tmpC:\Users\admin\AppData\Local\Temp\is-BNJ7P.tmp\mainlogo.pngimage
MD5:EB49CBD36D07CD5768271767269131F2
SHA256:A2825968B1C18604E678123FED0CCB6011D3CA0B6AB015E0DD84BA5D9F9F447A
5812dism_9kD-Ik1.bin.tmpC:\Users\admin\AppData\Local\Temp\is-BNJ7P.tmp\prod0executable
MD5:F1B24C502CBA4BA2608A7CD02B22DF60
SHA256:444208A6E64A582BD3B968D935F688BE837B185F13DAB2342F51C55DA109C8D5
5812dism_9kD-Ik1.bin.tmpC:\Users\admin\AppData\Local\Temp\is-BNJ7P.tmp\finish.pngimage
MD5:C22FCE016D422F84213A414D01CEE6D7
SHA256:26AAE139966F128AAC4185263E04DD8C7E65F42B3FDC81397EC80CC350E8BB12
5812dism_9kD-Ik1.bin.tmpC:\Users\admin\AppData\Local\Temp\is-BNJ7P.tmp\is-U6NBI.tmpimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
1108msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1c6d58.TMP —
MD5:—
SHA256:—
1108msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
5812dism_9kD-Ik1.bin.tmpC:\Users\admin\AppData\Local\Temp\is-BNJ7P.tmp\RAV_Cross.pngimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
92
TCP/UDP connections
258
DNS requests
185
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
308
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1722623250&P2=404&P3=2&P4=VY3ueS%2bV4AqqrNMpkbd7IokTsfa98Nanupz6RT55ksRH%2fc37to1i5b82j%2fRBhzUlmGtwzUa6h7VzodoMRGI%2fDg%3d%3d
unknown
—
—
whitelisted
308
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1722623250&P2=404&P3=2&P4=VY3ueS%2bV4AqqrNMpkbd7IokTsfa98Nanupz6RT55ksRH%2fc37to1i5b82j%2fRBhzUlmGtwzUa6h7VzodoMRGI%2fDg%3d%3d
unknown
—
—
whitelisted
7908
UnifiedStub-installer.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D
unknown
—
—
whitelisted
308
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1722623250&P2=404&P3=2&P4=VY3ueS%2bV4AqqrNMpkbd7IokTsfa98Nanupz6RT55ksRH%2fc37to1i5b82j%2fRBhzUlmGtwzUa6h7VzodoMRGI%2fDg%3d%3d
unknown
—
—
whitelisted
5812
dism_9kD-Ik1.bin.tmp
GET
200
95.168.168.24:80
http://dl.jalecdn.com/KR/dism.zip
unknown
—
—
unknown
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7908
UnifiedStub-installer.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTOQYLFSE5GO%2FpaRVfYu7d9gZEbQAQU2UEpsA8PY2zvadf1zSmepEhqMOYCEzMAAAAHN4xbodlbjNQAAAAAAAc%3D
unknown
—
—
whitelisted
308
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1722623250&P2=404&P3=2&P4=VY3ueS%2bV4AqqrNMpkbd7IokTsfa98Nanupz6RT55ksRH%2fc37to1i5b82j%2fRBhzUlmGtwzUa6h7VzodoMRGI%2fDg%3d%3d
unknown
—
—
whitelisted
308
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1722623250&P2=404&P3=2&P4=VY3ueS%2bV4AqqrNMpkbd7IokTsfa98Nanupz6RT55ksRH%2fc37to1i5b82j%2fRBhzUlmGtwzUa6h7VzodoMRGI%2fDg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5368
SearchApp.exe
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6572
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5368
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
unknown
6012
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5900
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
996
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1620
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.176
  • 2.23.209.189
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.179
  • 2.23.209.187
  • 2.23.209.193
  • 2.23.209.177
  • 184.86.251.22
  • 184.86.251.19
  • 184.86.251.7
  • 184.86.251.27
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
d1e9165hyidvf5.cloudfront.net
  • 18.244.20.154
  • 18.244.20.119
  • 18.244.20.27
  • 18.244.20.193
whitelisted
cdn.download.it
  • 104.22.57.224
  • 104.22.56.224
  • 172.67.26.92
whitelisted
dl.jalecdn.com
  • 95.168.168.24
unknown
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.67
  • 40.126.31.69
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.4
whitelisted

Threats

PID
Process
Class
Message
5812
dism_9kD-Ik1.bin.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dism_9kD-Ik1.bin