File name:

YuanTa.exe

Full analysis: https://app.any.run/tasks/8bac42d9-fdbf-49c2-8cc2-1348c9651017
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 00:27:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

28AA0CCDB3C6C3800B891D725B65CE07

SHA1:

47581521D1336892B3DDD592B8E59E11786DC5E2

SHA256:

58A36627C233F63EC75A4377B9E15E43DE52CB7B57813B92014C72562A02A0A0

SSDEEP:

24576:3Bg5mSSF+kAqY2lkFQiTBfkXgEdiIF1J03vY5ErG5hj0dl5iA2Wmr8OYzVWFzOl:3BvSSVAqY2lkFQiTBfkwEdic1J03vY58

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • YuanTa.exe (PID: 4880)
      • YuanTa.exe (PID: 7244)
      • YuanTa.tmp (PID: 7264)
      • EWinnerStart.exe (PID: 7800)
      • EWinnerStart.exe (PID: 1132)

    • Reads security settings of Internet Explorer

      • YuanTa.tmp (PID: 6048)
      • EWinnerStart.exe (PID: 7800)
      • EWinnerStart.exe (PID: 1132)
      • EWinner.exe (PID: 5772)

    • Reads the Windows owner or organization settings

      • YuanTa.tmp (PID: 7264)

    • Process drops legitimate windows executable

      • YuanTa.tmp (PID: 7264)
      • EWinnerStart.exe (PID: 1132)

    • Potential Corporate Privacy Violation

      • EWinnerStart.exe (PID: 7800)

    • Process requests binary or script from the Internet

      • EWinnerStart.exe (PID: 7800)
      • EWinner.exe (PID: 5772)

    • There is functionality for taking screenshot (YARA)

      • EWinnerStart.exe (PID: 7800)

    • Searches for installed software

      • EWinner.exe (PID: 5772)

  • INFO

    • Checks supported languages

      • YuanTa.tmp (PID: 6048)
      • YuanTa.exe (PID: 4880)
      • YuanTa.exe (PID: 7244)
      • YuanTa.tmp (PID: 7264)
      • EWinnerStart.exe (PID: 7800)
      • wusetup.exE (PID: 7900)
      • EWinnerStart.exe (PID: 1132)
      • EWinner.exe (PID: 5772)
      • PMMServer.exe (PID: 744)

    • Create files in a temporary directory

      • YuanTa.exe (PID: 4880)
      • YuanTa.exe (PID: 7244)
      • YuanTa.tmp (PID: 7264)

    • Reads the computer name

      • YuanTa.tmp (PID: 6048)
      • YuanTa.tmp (PID: 7264)
      • EWinnerStart.exe (PID: 7800)
      • EWinnerStart.exe (PID: 1132)
      • PMMServer.exe (PID: 744)
      • EWinner.exe (PID: 5772)

    • Process checks computer location settings

      • YuanTa.tmp (PID: 6048)
      • EWinnerStart.exe (PID: 7800)
      • EWinnerStart.exe (PID: 1132)

    • The sample compiled with english language support

      • YuanTa.tmp (PID: 7264)
      • EWinnerStart.exe (PID: 7800)
      • EWinnerStart.exe (PID: 1132)

    • Detects InnoSetup installer (YARA)

      • YuanTa.exe (PID: 4880)
      • YuanTa.tmp (PID: 6048)

    • Creates files in the program directory

      • YuanTa.tmp (PID: 7264)

    • The sample compiled with chinese language support

      • YuanTa.tmp (PID: 7264)
      • EWinnerStart.exe (PID: 7800)
      • EWinnerStart.exe (PID: 1132)

    • Compiled with Borland Delphi (YARA)

      • YuanTa.tmp (PID: 6048)
      • EWinnerStart.exe (PID: 7800)

    • Checks proxy server information

      • EWinnerStart.exe (PID: 1132)
      • EWinnerStart.exe (PID: 7800)
      • EWinner.exe (PID: 5772)

    • Reads the machine GUID from the registry

      • EWinnerStart.exe (PID: 1132)
      • PMMServer.exe (PID: 744)

    • Reads the software policy settings

      • EWinnerStart.exe (PID: 1132)
      • slui.exe (PID: 7336)

    • Creates files or folders in the user directory

      • EWinnerStart.exe (PID: 1132)

    • The sample compiled with spanish language support

      • EWinnerStart.exe (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (71.1)
.exe | Win32 Executable Delphi generic (9.1)
.scr | Windows screen saver (8.4)
.dll | Win32 Dynamic Link Library (generic) (4.2)
.exe | Win32 Executable (generic) (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 40448
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xa5f8
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Yuanta
FileDescription: 元大點金靈 Setup
FileVersion:
LegalCopyright:
ProductName: 元大點金靈
ProductVersion: 2.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start yuanta.exe yuanta.tmp no specs yuanta.exe yuanta.tmp sppextcomobj.exe no specs slui.exe ewinnerstart.exe wusetup.exe no specs ewinnerstart.exe ewinner.exe pmmserver.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744C:\TWEWinner\PMMServer.exeC:\TWEWinner\PMMServer.exe
EWinner.exe
User:
admin
Company:
元大證券
Integrity Level:
HIGH
Exit code:
0
Version:
2.0.14.41
Modules
Images
c:\twewinner\pmmserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1132C:\TWEWinner\EWinnerStart.exe /fC:\TWEWinner\EWinnerStart.exe
wusetup.exE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
2.0.4.0
Modules
Images
c:\twewinner\ewinnerstart.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4880"C:\Users\admin\AppData\Local\Temp\YuanTa.exe" C:\Users\admin\AppData\Local\Temp\YuanTa.exe
explorer.exe
User:
admin
Company:
Yuanta
Integrity Level:
MEDIUM
Description:
元大點金靈 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\yuanta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5772"C:\TWEWinner\EWinner.exe" POLARISTWSUPERC:\TWEWinner\EWinner.exe
EWinnerStart.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
0.3.3.5
Modules
Images
c:\twewinner\ewinner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6048"C:\Users\admin\AppData\Local\Temp\is-A9KK9.tmp\YuanTa.tmp" /SL5="$80292,461988,56832,C:\Users\admin\AppData\Local\Temp\YuanTa.exe" C:\Users\admin\AppData\Local\Temp\is-A9KK9.tmp\YuanTa.tmp—YuanTa.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a9kk9.tmp\yuanta.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6644C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7244"C:\Users\admin\AppData\Local\Temp\YuanTa.exe" /SPAWNWND=$5030A /NOTIFYWND=$80292 C:\Users\admin\AppData\Local\Temp\YuanTa.exe
YuanTa.tmp
User:
admin
Company:
Yuanta
Integrity Level:
HIGH
Description:
元大點金靈 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\yuanta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7264"C:\Users\admin\AppData\Local\Temp\is-PLM08.tmp\YuanTa.tmp" /SL5="$4025A,461988,56832,C:\Users\admin\AppData\Local\Temp\YuanTa.exe" /SPAWNWND=$5030A /NOTIFYWND=$80292 C:\Users\admin\AppData\Local\Temp\is-PLM08.tmp\YuanTa.tmp
YuanTa.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-plm08.tmp\yuanta.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7300C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7336"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 726
Read events
3 658
Write events
68
Delete events
0

Modification events

(PID) Process:(7800) EWinnerStart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Polaris\TWEWinner
Operation:writeName:URLProxyIDPWD
Value:
0
(PID) Process:(1132) EWinnerStart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Polaris\TWEWinner
Operation:writeName:URLProxyIDPWD
Value:
0
(PID) Process:(5772) EWinner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9339F04E-6BF0-421F-B540-9F94CF062EFA}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(5772) EWinner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9339F04E-6BF0-421F-B540-9F94CF062EFA}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(5772) EWinner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7F6C4F07-C855-4D69-A924-99D1AD2CB402}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(5772) EWinner.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F6C4F07-C855-4D69-A924-99D1AD2CB402}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(5772) EWinner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Polaris\TWEWinner
Operation:writeName:Installed
Value:
1
(PID) Process:(5772) EWinner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Polaris\TWEWinner
Operation:writeName:FontSize
Value:
9
(PID) Process:(5772) EWinner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Polaris\TWEWinner
Operation:writeName:AlphaBlend
Value:
255
(PID) Process:(5772) EWinner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Polaris\TWEWinner
Operation:writeName:AutoLogout
Value:
0
Executable files
134
Suspicious files
52
Text files
29
Unknown types
0

Dropped files

PID
Process
Filename
Type
4880YuanTa.exeC:\Users\admin\AppData\Local\Temp\is-A9KK9.tmp\YuanTa.tmpexecutable
MD5:2C10DB017057DCE22651243244E4FEE6
SHA256:E442E83C27E94BC37EB6C02411A88EDD8CB83777D50312B9EF7BFC214C4CC7B2
7264YuanTa.tmpC:\Users\admin\AppData\Local\Temp\is-78EBM.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7264YuanTa.tmpC:\TWEWinner\is-TVQBJ.tmpexecutable
MD5:9621CE6FEFC7D99AFD4B6A73CA3AD33E
SHA256:0989BB3BA5BA6EBBFAC015AC8136F4F713C129D301B4530B664E168ED90DF6DB
7800EWinnerStart.exeC:\TWEWinner\Temp\WUPEBAA.tmptext
MD5:D6E45B5B53DB72CC9B22413FD4ABF783
SHA256:55DCBF8A0D2CF593D11A9264A6147D435292D5F204A92912580CC551046E163A
7244YuanTa.exeC:\Users\admin\AppData\Local\Temp\is-PLM08.tmp\YuanTa.tmpexecutable
MD5:2C10DB017057DCE22651243244E4FEE6
SHA256:E442E83C27E94BC37EB6C02411A88EDD8CB83777D50312B9EF7BFC214C4CC7B2
7264YuanTa.tmpC:\Users\admin\AppData\Local\Temp\is-78EBM.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
7800EWinnerStart.exeC:\TWEWinner\Temp\WUPAD2.tmp —
MD5:—
SHA256:—
7800EWinnerStart.exeC:\TWEWinner\Cab\ExeLib.cab —
MD5:—
SHA256:—
7264YuanTa.tmpC:\Users\Public\Desktop\ÂIª÷ÆF.lnkbinary
MD5:9221335D05BD9F1DC7C4EA9E0210E340
SHA256:5C2EE86C7D4AE774709D1A7833C689A18B8B9EB66C673CC1A2106FB675264DC7
7800EWinnerStart.exeC:\TWEWinner\Temp\EWinnerStart.txttext
MD5:D6E45B5B53DB72CC9B22413FD4ABF783
SHA256:55DCBF8A0D2CF593D11A9264A6147D435292D5F204A92912580CC551046E163A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
31
DNS requests
25
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7800
EWinnerStart.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/twewinner/IniFile.cab?FileTick=1125296
unknown
—
—
unknown
7800
EWinnerStart.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/twewinner/Language.cab?FileTick=1131375
unknown
—
—
unknown
7800
EWinnerStart.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/twewinner/KernelBPL.cab?FileTick=1125578
unknown
—
—
unknown
7800
EWinnerStart.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/twewinner/PMMServer.cab?FileTick=1131703
unknown
—
—
unknown
7800
EWinnerStart.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/twewinner/ShareBpl.cab?FileTick=1132500
unknown
—
—
unknown
7800
EWinnerStart.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/twewinner/FunListi.cab?FileTick=1133250
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4380
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.4
  • 20.190.160.17
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.140
  • 20.190.160.67
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ewinnerupdate.yuanta.com.tw
  • 203.69.51.222
unknown
ys.yuanta.com.tw
  • 203.69.51.222
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
7800
EWinnerStart.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
YuanTa.exe