File name:

ffdec_22.0.2_nightly3027_setup.exe

Full analysis: https://app.any.run/tasks/07b5d4d6-435c-4bb6-928a-c73c88205181
Verdict: Malicious activity
Analysis date: March 09, 2025, 22:26:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections
MD5:

92D256FA1225812313DB3187A6985760

SHA1:

C2E869038670594D621AAE3FD7F973A1E8FB7C73

SHA256:

615946C60EFC8230866C3B338C5B53827C27808297677F52ED4D161DFEA7C1D2

SSDEEP:

98304:MWh/+ojZmPNV13Go5SrKj9QPZDsiSt9JLIkzPD7Zfgmvdvuf/IqWS7yZLs2epXwz:uBvfM+OHbOh9lWuNt/qK6wHwhy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates a software uninstall entry

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

    • Executable content was dropped or overwritten

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • There is functionality for taking screenshot (YARA)

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Checks for Java to be installed

      • ffdec.exe (PID: 7152)
      • ffdec.exe (PID: 6572)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

    • Searches for installed software

      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 3768)

    • The process creates files with name similar to system file names

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

  • INFO

    • Create files in a temporary directory

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 6964)
      • BackgroundTransferHost.exe (PID: 3020)
      • BackgroundTransferHost.exe (PID: 5504)
      • BackgroundTransferHost.exe (PID: 1512)
      • BackgroundTransferHost.exe (PID: 1088)

    • Creates files in the program directory

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)

    • Reads the computer name

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • ffdec.exe (PID: 7152)
      • javaw.exe (PID: 3888)
      • ffdec.exe (PID: 6572)
      • javaw.exe (PID: 4736)
      • ShellExperienceHost.exe (PID: 3768)

    • Checks supported languages

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • ffdec.exe (PID: 7152)
      • javaw.exe (PID: 3888)
      • ffdec.exe (PID: 6572)
      • javaw.exe (PID: 4736)
      • ShellExperienceHost.exe (PID: 3768)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6964)
      • slui.exe (PID: 6476)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6964)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6964)
      • slui.exe (PID: 6476)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Manual execution by a user

      • ffdec.exe (PID: 6572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:29 12:07:21+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.42
CodeSize: 37888
InitializedDataSize: 61952
UninitializedDataSize: 129024
EntryPoint: 0x45a4
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ffdec_22.0.2_nightly3027_setup.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs ffdec.exe no specs javaw.exe icacls.exe no specs conhost.exe no specs ffdec.exe no specs javaw.exe slui.exe shellexperiencehost.exe no specs ffdec_22.0.2_nightly3027_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1088"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1512"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3020"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3768"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
3888"C:\Users\admin\AppData\Local\Temp\ffdec_22.0.2_nightly3027_setup.exe" C:\Users\admin\AppData\Local\Temp\ffdec_22.0.2_nightly3027_setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\ffdec_22.0.2_nightly3027_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3888"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -Xmx4091m -Djava.net.preferIPv4Stack=true -Djna.nosys=true -Djava.util.Arrays.useLegacyMergeSort=true -Dl5j.pid=7152 -Dl5j.encargs=1 -jar "C:\PROGRA~2\FFDec\ffdec.jar"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
ffdec.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4628C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4736"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -Xmx4091m -Djava.net.preferIPv4Stack=true -Djna.nosys=true -Djava.util.Arrays.useLegacyMergeSort=true -Dl5j.pid=6572 -Dl5j.encargs=1 -jar "C:\PROGRA~2\FFDec\ffdec.jar" C%3A%5CUsers%5Cadmin%5CDesktop%5Cgtaiv.swfC:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
ffdec.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5504"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
4 950
Read events
4 915
Write events
34
Delete events
1

Modification events

(PID) Process:(1512) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1512) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1512) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6964) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6964) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6964) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
36
Suspicious files
23
Text files
221
Unknown types
0

Dropped files

PID
Process
Filename
Type
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0ac36734-3142-4525-a8cf-bb8f9aa2ff6d.down_data —
MD5:—
SHA256:—
5728ffdec_22.0.2_nightly3027_setup.exeC:\Users\admin\AppData\Local\Temp\nsdBFC9.tmp\LangDLL.dllexecutable
MD5:6A4CE8D10EFD06369F368898462546E0
SHA256:42C46CDE21B03935314697EF444B01D85E319FC443519BDE35FEC90C8B21FC98
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\ffdec.jarjava
MD5:714D0841583A9B4C175B9C017B018290
SHA256:95CB0C7081D404BF1BC3D292325AB73774CB004BB8DEE29A2FF7FDD788CA3E3B
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0ac36734-3142-4525-a8cf-bb8f9aa2ff6d.b0b7f468-2a61-45ab-b0ef-402970d3c4ef.down_metabinary
MD5:23A4FD68AA72E94644677A85A776AF4F
SHA256:74759AF04DE6CB758F3C2F29D76756FA8CF34CD9C12D73B6461D33AA07CB06D6
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\icon.icoimage
MD5:E6A62514AE4EF4FF4580CB0E72844FEB
SHA256:00C81B847ACF7D4E5225BC81372848BA8136C777F5ABF3A69CEF0AC2DCDFE10E
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\ffdec.exeexecutable
MD5:65D77CDDBFC1FD4A65D2AB4C3BD3A1FC
SHA256:0D63FB9A32282920A695A8D8E50A82B66B095F8970F005A22C3A74E9A5035248
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:AD65BBA990E9A146C8789184B44B3332
SHA256:C57BBFD31CE81C873E766C5DEEE854B02BFF08020DF9BE1A3B4562BD67CC932D
5728ffdec_22.0.2_nightly3027_setup.exeC:\Users\admin\AppData\Local\Temp\nsdBFC9.tmp\modern-wizard.bmpimage
MD5:BB808C94D09FBEF5F30B8B501566B7D1
SHA256:5B27F52572BDCFEA2454D27B5C22050A741B47A4EB866616007A44B82752892E
5728ffdec_22.0.2_nightly3027_setup.exeC:\Users\admin\AppData\Local\Temp\nsdBFC9.tmp\modern-header.bmpimage
MD5:6C89D5A7C988506755C68DE07E6505F2
SHA256:7324B33545FC9FDD9C0FEE0597ABE552982E6FF755B9EC1D7F81927D9450DE9C
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\ffdec.battext
MD5:D1C38A79BEF0B2E148CBF0326A104533
SHA256:ED9F3D97EF0F1447E5CD048725C9DF4AC009CC2C7EC93A2ADE43B36854878690
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6964
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5256
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5256
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5256
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6964
BackgroundTransferHost.exe
104.126.37.147:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.140
  • 20.190.160.132
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.130
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.147
  • 104.126.37.186
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.137
  • 104.126.37.184
  • 104.126.37.152
  • 104.126.37.123
  • 104.126.37.136
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ffdec_22.0.2_nightly3027_setup.exe