URL:

http://sfdl.360safe.com/360instexe_a25963787bffe14c50a838032e06dad2_2.5.0.1153.cab

Full analysis: https://app.any.run/tasks/02c40a6a-da1e-4b31-ad56-6cdf1521aa51
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 01, 2024, 07:19:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
arch-exec
arch-doc
qrcode
arch-scr
arch-html
vmprotect
exploit
Indicators:
MD5:

2D92B7F5A1F87062A9E1303A653B621D

SHA1:

1AA7358B6FE096B958F520CD6289A7C50728B13D

SHA256:

56D8AA7BBDC92F5CF8FCB81D57331A0BD8B6FCEA526C8ACB4D19E3A4A147275E

SSDEEP:

3:N1KND/wVoLmVMmo1SSDlgAEUdpk6beCxu:CyNmmMSwlMEleCxu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • 360sd_x64_5.0.0.8140.exe (PID: 5496)

    • Executing a file with an untrusted certificate

      • dep360.exe (PID: 5000)
      • 360sd.exe (PID: 6920)
      • setup.exe (PID: 4968)
      • setup64.exe (PID: 4804)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • 360Inst.exe (PID: 5752)

    • Executable content was dropped or overwritten

      • 360Inst.exe (PID: 5752)
      • setup_13.0.0.2008g.exe (PID: 7116)
      • 360sd_x64_5.0.0.8140.exe (PID: 5496)
      • 360rp.exe (PID: 1616)
      • setup.exe (PID: 4968)
      • 360se.exe (PID: 7036)

    • Process requests binary or script from the Internet

      • 360Inst.exe (PID: 5752)

    • Drops 7-zip archiver for unpacking

      • setup_13.0.0.2008g.exe (PID: 7116)
      • 360sd_x64_5.0.0.8140.exe (PID: 5496)

    • Starts CMD.EXE for commands execution

      • 360sd_x64_5.0.0.8140.exe (PID: 5496)

    • Drops a system driver (possible attempt to evade defenses)

      • 360sd_x64_5.0.0.8140.exe (PID: 5496)
      • 360rp.exe (PID: 1616)
      • setup_13.0.0.2008g.exe (PID: 7116)

    • Executes as Windows Service

      • 360rps.exe (PID: 7156)

    • Process drops legitimate windows executable

      • setup.exe (PID: 4968)

    • The process drops C-runtime libraries

      • setup.exe (PID: 4968)

    • Application launched itself

      • 360se.exe (PID: 7036)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3140)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4668)
      • chrome.exe (PID: 5080)

    • The process uses the downloaded file

      • chrome.exe (PID: 4392)
      • chrome.exe (PID: 3140)

    • VMProtect protector has been detected

      • setup_13.0.0.2008g.exe (PID: 7116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
48
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe 360inst.exe no specs 360inst.exe setup_13.0.0.2008g.exe chrome.exe 360sd_x64_5.0.0.8140.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs chrome.exe no specs bcdedit.exe no specs bcdedit.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs 360rps.exe no specs dep360.exe no specs regsvr32.exe no specs regsvr32.exe no specs dep360.exe no specs chrome.exe no specs 360sd.exe no specs 360rps.exe no specs 360rp.exe wsccontrol.exe no specs chrome.exe no specs wsccontrol.exe no specs 360safe_se.exe no specs setup.exe chrome.exe no specs setup64.exe no specs chrome.exe no specs 360se.exe 360se.exe no specs 360se.exe no specs 360se.exe no specs 360se.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
68"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5476 --field-trial-handle=1896,i,13793833207518470948,2305107607953269409,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5464 --field-trial-handle=1896,i,13793833207518470948,2305107607953269409,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
1400"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\360SD\360sdbho.dll"C:\Windows\SysWOW64\regsvr32.exe—360sd_x64_5.0.0.8140.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1544"C:\Users\admin\AppData\Roaming\360se6\Application\360se.exe" --type=renderer --disable-direct-write --primordial-pipe-token=431B368718925797FA53E56C326072EA --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --service-request-channel-token=431B368718925797FA53E56C326072EA --mojo-platform-channel-handle=2560 /prefetch:1 /prefetch:673131151C:\Users\admin\AppData\Roaming\360se6\Application\360se.exe—360se.exe
User:
admin
Company:
360.cn
Integrity Level:
LOW
Description:
360安全浏览器
Version:
9.1.0.410
1616"C:\Program Files (x86)\360\360SD\360rp.exe" /runC:\Program Files (x86)\360\360SD\360rp.exe
360sd.exe
User:
admin
Company:
360.cn
Integrity Level:
HIGH
Description:
360杀毒 实时监控
Version:
5, 0, 0, 5076
2148"C:\Program Files (x86)\360\360SD\360rps.exe" /installC:\Program Files (x86)\360\360SD\360rps.exe—360sd_x64_5.0.0.8140.exe
User:
admin
Company:
360.cn
Integrity Level:
HIGH
Description:
360杀毒 服务程序
Exit code:
0
Version:
5, 0, 0, 8071
Modules
Images
c:\program files (x86)\360\360sd\360rps.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2220"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5028 --field-trial-handle=1896,i,13793833207518470948,2305107607953269409,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2220"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5388 --field-trial-handle=1896,i,13793833207518470948,2305107607953269409,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
2828"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\360SD\MenuEx.dll"C:\Windows\SysWOW64\regsvr32.exe—360sd_x64_5.0.0.8140.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3140"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints "http://sfdl.360safe.com/360instexe_a25963787bffe14c50a838032e06dad2_2.5.0.1153.cab"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
14 865
Read events
9 493
Write events
1 863
Delete events
3 509

Modification events

(PID) Process:(3140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3140) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(4392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000017D0C61C143DB01
(PID) Process:(3140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\OpenWithProgids
Operation:writeName:WinRAR
Value:
(PID) Process:(4668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
668
Suspicious files
855
Text files
872
Unknown types
40

Dropped files

PID
Process
Filename
Type
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF13698b.TMP —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF13698b.TMP —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF13698b.TMP —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF13699a.TMP —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1369c9.TMP —
MD5:—
SHA256:—
3140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1369c9.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
333
TCP/UDP connections
435
DNS requests
234
Threats
136

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5752
360Inst.exe
GET
200
39.156.85.230:80
http://ini.update.360safe.com/instcomp.htm?soft=323&status=24&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&usetime=2&pid=h_home_haohua?soft=323&status=24&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&usetime=2&pid=h_home_haohua&gslb=1
unknown
—
—
whitelisted
5752
360Inst.exe
GET
200
39.156.85.201:80
http://pinst.360.cn/360haohua/safe_chaoqiang.cab?value=10283&mid=80342cb959da2233832ae840f019ccba
unknown
—
—
whitelisted
5752
360Inst.exe
GET
200
39.156.85.230:80
http://ini.update.360safe.com/instcomp.htm?soft=323&status=6&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&new=1&pid=h_home_haohua?soft=323&status=6&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&new=1&pid=h_home_haohua&gslb=1
unknown
—
—
whitelisted
5752
360Inst.exe
GET
302
220.181.150.177:80
http://update.360safe.com/instcomp.htm?soft=323&status=24&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&usetime=2&pid=h_home_haohua
unknown
—
—
whitelisted
5752
360Inst.exe
GET
302
220.181.150.177:80
http://update.360safe.com/instcomp.htm?soft=323&status=9&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&new=1&pid=h_home_haohua
unknown
—
—
whitelisted
5752
360Inst.exe
GET
200
39.156.85.230:80
http://ini.update.360safe.com/instcomp.htm?soft=323&status=9&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&new=1&pid=h_home_haohua?soft=323&status=9&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&new=1&pid=h_home_haohua&gslb=1
unknown
—
—
whitelisted
5752
360Inst.exe
GET
302
220.181.150.177:80
http://update.360safe.com/instcomp.htm?soft=323&status=6&mid=80342cb959da2233832ae840f019ccba&from=zz_cq&ver=2.5.0.1153&count=1&new=1&pid=h_home_haohua
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2992
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
104.126.37.185:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3140
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6352
chrome.exe
142.250.110.84:443
accounts.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.129
  • 104.126.37.131
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.137
  • 104.126.37.128
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
sfdl.360safe.com
  • 111.174.12.113
  • 183.204.210.219
  • 113.219.144.65
  • 116.162.210.150
  • 111.6.17.145
  • 111.7.66.168
  • 119.36.124.159
  • 175.6.201.25
  • 123.6.65.56
  • 111.6.255.145
whitelisted
accounts.google.com
  • 142.250.110.84
whitelisted
www.google.com
  • 172.217.18.4
whitelisted
sb-ssl.google.com
  • 216.58.206.46
whitelisted

Threats

PID
Process
Class
Message
5752
360Inst.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5752
360Inst.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5752
360Inst.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
—
—
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Adware
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://sfdl.360safe.com/360instexe_a25963787bffe14c50a838032e06dad2_2.5.0.1153.cab