File name:

dropper.exe

Full analysis: https://app.any.run/tasks/abc00404-37f6-4954-9cc6-703394c4939a
Verdict: Malicious activity
Analysis date: April 04, 2026, 12:13:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
python
pyinstaller
advancedipscanner
tool
scan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

6D4F0B2031F65DB77754B169535EFC9A

SHA1:

E7CC043219B5AD89A31F6E45E9164777FD3AF96D

SHA256:

600F5DF47B8B827426EEF392D0D6FE020F183D0370F9925FBA3006850F53347A

SSDEEP:

98304:NgsEUs3Ix4oQYaVxYIvR7ausMgM5nShANeEONfSSj5JLEQUTo67T9ixh3SIZP++b:zqNbD64lFTd8CUcjK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • installer.exe (PID: 7576)
      • advanced_ip_scanner.exe (PID: 7420)

  • SUSPICIOUS

    • Process drops python dynamic module

      • dropper.exe (PID: 7096)
      • clicker.exe (PID: 6024)

    • The process drops C-runtime libraries

      • dropper.exe (PID: 7096)
      • clicker.exe (PID: 6024)
      • msiexec.exe (PID: 7216)

    • Executable content was dropped or overwritten

      • dropper.exe (PID: 7096)
      • dropper.exe (PID: 5196)
      • installer.exe (PID: 7576)
      • clicker.exe (PID: 6024)
      • installer.tmp (PID: 7760)

    • Application launched itself

      • dropper.exe (PID: 7096)
      • clicker.exe (PID: 6024)

    • Loads Python modules

      • dropper.exe (PID: 5196)
      • clicker.exe (PID: 6108)

    • Reads the Windows owner or organization settings

      • installer.tmp (PID: 7760)
      • msiexec.exe (PID: 7216)

    • Detection of a Network Scan

      • advanced_ip_scanner.exe (PID: 7420)

  • INFO

    • Checks supported languages

      • dropper.exe (PID: 7096)
      • dropper.exe (PID: 5196)
      • installer.exe (PID: 7576)
      • installer.tmp (PID: 7760)
      • clicker.exe (PID: 6108)
      • clicker.exe (PID: 6024)
      • msiexec.exe (PID: 1268)
      • msiexec.exe (PID: 6912)
      • advanced_ip_scanner.exe (PID: 7420)
      • msiexec.exe (PID: 7216)

    • Reads the computer name

      • dropper.exe (PID: 7096)
      • dropper.exe (PID: 5196)
      • installer.tmp (PID: 7760)
      • clicker.exe (PID: 6024)
      • clicker.exe (PID: 6108)
      • msiexec.exe (PID: 1268)
      • msiexec.exe (PID: 6912)
      • advanced_ip_scanner.exe (PID: 7420)
      • msiexec.exe (PID: 7216)

    • The sample compiled with english language support

      • dropper.exe (PID: 7096)
      • clicker.exe (PID: 6024)
      • installer.tmp (PID: 7760)
      • msiexec.exe (PID: 7216)

    • Create files in a temporary directory

      • dropper.exe (PID: 7096)
      • dropper.exe (PID: 5196)
      • installer.exe (PID: 7576)
      • clicker.exe (PID: 6024)
      • clicker.exe (PID: 6108)
      • installer.tmp (PID: 7760)

    • PyInstaller has been detected (YARA)

      • dropper.exe (PID: 7096)

    • ADVANCEDIPSCANNER mutex has been found

      • installer.tmp (PID: 7760)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7216)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7216)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7216)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7216)

    • Reads the machine GUID from the registry

      • advanced_ip_scanner.exe (PID: 7420)
      • msiexec.exe (PID: 7216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:04:04 12:12:58+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 186880
InitializedDataSize: 157696
UninitializedDataSize: -
EntryPoint: 0xd4a0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
15
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dropper.exe conhost.exe no specs dropper.exe slui.exe no specs installer.exe installer.tmp clicker.exe clicker.exe no specs UIAutomationCrossBitnessHook32 Class no specs RemoteProxyFactory32 Class no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs RemoteProxyFactory32 Class no specs advanced_ip_scanner.exe

Process information

PID
CMD
Path
Indicators
Parent process
1268C:\Windows\syswow64\MsiExec.exe -Embedding B5FCA221D365942829FE2443D41F0126C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2940C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{53362C32-A296-4F2D-A2F8-FD984D08340B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
4236C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
5196"C:\Users\admin\AppData\Local\Temp\dropper.exe" C:\Users\admin\AppData\Local\Temp\dropper.exe
dropper.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dropper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—dropper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5764C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{53362C32-A296-4F2D-A2F8-FD984D08340B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
6024C:\Users\admin\AppData\Local\Temp\clicker.exeC:\Users\admin\AppData\Local\Temp\clicker.exe
dropper.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\clicker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6108C:\Users\admin\AppData\Local\Temp\clicker.exeC:\Users\admin\AppData\Local\Temp\clicker.exe—clicker.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\clicker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6912C:\Windows\syswow64\MsiExec.exe -Embedding 3A3DF5FC9E346EB13DE6D80B6111B51F E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7096"C:\Users\admin\AppData\Local\Temp\dropper.exe" C:\Users\admin\AppData\Local\Temp\dropper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dropper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
9 340
Read events
9 051
Write events
280
Delete events
9

Modification events

(PID) Process:(7848) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
(PID) Process:(7216) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
301C000040A60D8F2CC4DC01
(PID) Process:(7216) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
8631CADE14A9C4D8194516D8E5755E040E86BFB87B7AF6252119A198A893FDA6
(PID) Process:(7216) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(1268) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(1268) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
D2AA0E0000000000
(PID) Process:(7216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7573AC87B1EB0A64A96A391F57B23603
Operation:writeName:BEA1158CC418F6D4AA544430E5DA65B3
Value:
C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner_console.exe
(PID) Process:(7216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6681EC35EB8D6040B12D6F536D200A6
Operation:writeName:BEA1158CC418F6D4AA544430E5DA65B3
Value:
02:\software\famatech\advanced_ip_scanner\locale
(PID) Process:(7216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95472F7764E861444A5EE01CE47560E7
Operation:writeName:BEA1158CC418F6D4AA544430E5DA65B3
Value:
C:\Program Files (x86)\Advanced IP Scanner\libeay32.dll
(PID) Process:(7216) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\992AC42407AC14E41BAA1AA950CD42FD
Operation:writeName:BEA1158CC418F6D4AA544430E5DA65B3
Value:
C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner_es_es.qm
Executable files
128
Suspicious files
68
Text files
53
Unknown types
0

Dropped files

PID
Process
Filename
Type
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\charset_normalizer\cd.cp314-win_amd64.pydexecutable
MD5:C143DE5868E6FE3B971B6A28C8371275
SHA256:50BE712BD48A41886BAE173F47718AC8963FCACACCCEB23B41C3C38417E97146
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_wmi.pydexecutable
MD5:72A4DFA925A2B6326A005601DCC4CB34
SHA256:A299A6CAF7241CEBB0081C3ED9E98F815C61FEEE3E4813C1FD32369BD3FE6F5E
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_decimal.pydexecutable
MD5:5BCFD857DC1088DCE3CBD43BFEBBA363
SHA256:DCC9555EAF911AF7997777B94BEEA78F802A10F1E4F3C3D4DF2F254D44C71797
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_overlapped.pydexecutable
MD5:B256A437057703F7D10F64EBD3BE281A
SHA256:03B191B897BE7F98E177A8CCFFD5DF76305720D3CE16A979ABFCA3F6223F4D13
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pydexecutable
MD5:EB28ACB0552CAA2738DC0C63871D5D9D
SHA256:1D1850E744601363F5315803310BEA2D0C0FA8CF133255055D973620F3AB79F3
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\VCRUNTIME140_1.dllexecutable
MD5:C0C0B4C611561F94798B62EB43097722
SHA256:497A280550443E3E9F89E428E51CB795139CA8944D5DEDD54A7083C00E7164E5
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_asyncio.pydexecutable
MD5:E9FF314ADB895F5AEFF2ACC7DE8AD7F4
SHA256:F9DC3B563E0B313E3FA5364C2F14B1FE08D004D70126A6DE5D78826DB77C6318
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_ctypes.pydexecutable
MD5:208E7DD066F23080DA03B4EBD20FBC43
SHA256:A11D680D89F054584E6A5B2A03103D8731DEF86E367AFF2F70CCE8C6367F9025
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_bz2.pydexecutable
MD5:B831FF0AB5F28A1F3BAE6842896D45FF
SHA256:082A761A280B08AFECF6FB0509050FFBF7E87D1638CA49466B8B3EB4C85009B4
7096dropper.exeC:\Users\admin\AppData\Local\Temp\_MEI70962\_hashlib.pydexecutable
MD5:4F7F664E8558A6CFC93EDE2AE9D6974A
SHA256:0C11671A2C572B4C016BE263789F238125419DF5711E281ACDCE8DA50D9BADDA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
31
DNS requests
26
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
6836
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
6836
SIHClient.exe
GET
200
74.179.77.164:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
6836
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
6836
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7784
svchost.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
7784
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7784
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7784
svchost.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
text
5.74 Kb
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/FlightSettings/FSService?ProcessorClockSpeed=3094&IsRetailOS=1&OEMManufacturerName=DELL&FlightingPolicyValue=3&EnablePreviewBuilds=4294967295&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&ManagePreviewBuilds=3&BranchReadinessLevelSource=0&AttrDataVer=186&ProcessorCores=6&BranchReadinessLevelRaw=16&TotalPhysicalRAM=6144&TPMVersion=0&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&DeviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&App=FSS&AppVer=10.0&SmartActiveHoursState=1&ActiveHoursStart=20&SecureBootCapable=0&ActiveHoursEnd=13&DeviceFamily=Windows.Desktop
US
text
87.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7784
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.204.139:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
6232
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5196
dropper.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
5196
dropper.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted
7784
svchost.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7784
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.16.204.139
  • 2.16.204.157
  • 2.16.204.138
  • 2.16.204.155
  • 2.16.204.152
  • 2.16.204.153
  • 2.16.204.146
  • 2.16.204.147
  • 2.16.204.150
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
google.com
  • 142.251.14.102
  • 142.251.14.113
  • 142.251.14.138
  • 142.251.14.139
  • 142.251.14.100
  • 142.251.14.101
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.111.133
whitelisted
github.com
  • 140.82.121.3
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted

Threats

PID
Process
Class
Message
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7784
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7420
advanced_ip_scanner.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7420
advanced_ip_scanner.exe
Detection of a Network Scan
ET ADWARE_PUP IP Scanner Tool Update Request (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dropper.exe