File name:

Endermanch@WinlockerVB6Blacksod.exe

Full analysis: https://app.any.run/tasks/ace896fd-6f5c-44f0-8ceb-a90483cad981
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 21:32:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
adware
takemyfile
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

DBFBF254CFB84D991AC3860105D66FC6

SHA1:

893110D8C8451565CAA591DDFCCF92869F96C242

SHA256:

68B0E1932F3B4439865BE848C2D592D5174DBDBAAB8F66104A0E5B28C928EE0C

SSDEEP:

49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a new scheduled task via Registry

      • msiexec.exe (PID: 5164)

    • ADWARE has been detected (SURICATA)

      • msiexec.exe (PID: 1280)

    • Changes the login/logoff helper path in the registry

      • msiexec.exe (PID: 5668)

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)

    • Process drops legitimate windows executable

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)

    • Executable content was dropped or overwritten

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5668)
      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1280)

    • Access to an unwanted program domain was detected

      • msiexec.exe (PID: 1280)

  • INFO

    • Checks supported languages

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)
      • msiexec.exe (PID: 5668)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 5164)

    • The sample compiled with english language support

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)
      • msiexec.exe (PID: 5668)

    • Creates files or folders in the user directory

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)

    • Reads the computer name

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)
      • msiexec.exe (PID: 5668)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 5164)

    • Reads Environment values

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)
      • msiexec.exe (PID: 1280)

    • Create files in a temporary directory

      • Endermanch@WinlockerVB6Blacksod.exe (PID: 4436)
      • msiexec.exe (PID: 1280)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5668)

    • Checks proxy server information

      • msiexec.exe (PID: 1280)

    • Reads the software policy settings

      • slui.exe (PID: 1660)

    • Manual execution by a user

      • mspaint.exe (PID: 5436)
      • WINWORD.EXE (PID: 2040)
      • mspaint.exe (PID: 5552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (78.5)
.exe | Win32 Executable (generic) (11.3)
.exe | Generic Win/DOS Executable (5)
.exe | DOS Executable Generic (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:09:23 13:36:22+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 1034240
InitializedDataSize: 428544
UninitializedDataSize: -
EntryPoint: 0xc684c
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Windows
FileDescription: This installer database contains the logic and data required to install Error file remover.
FileVersion: 1.0.0.0
InternalName: Error file remover
LegalCopyright: Copyright (C) 2016 Windows
OriginalFileName: Error file remover.exe
ProductName: Error file remover
ProductVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
13
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start endermanch@winlockervb6blacksod.exe msiexec.exe msiexec.exe no specs sppextcomobj.exe no specs slui.exe #ADWARE msiexec.exe msiexec.exe no specs rundll32.exe no specs mspaint.exe no specs slui.exe no specs mspaint.exe no specs winword.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1280C:\Windows\syswow64\MsiExec.exe -Embedding 63F2882F70E4CBFA2072CCCB4EAA774AC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1660"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1672C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2040"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\russianphotos.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4200"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\admin\AppData\Local\Temp\Endermanch@WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "C:\Windows\SysWOW64\msiexec.exe—Endermanch@WinlockerVB6Blacksod.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4436"C:\Users\admin\AppData\Local\Temp\Endermanch@WinlockerVB6Blacksod.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@WinlockerVB6Blacksod.exe
explorer.exe
User:
admin
Company:
Windows
Integrity Level:
MEDIUM
Description:
This installer database contains the logic and data required to install Error file remover.
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\endermanch@winlockervb6blacksod.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5164C:\Windows\syswow64\MsiExec.exe -Embedding E59602D77F93A59F6CAC4A1B16CA3662 E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5436"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\serverwest.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5552"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\reasonlevel.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5668C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
16 295
Read events
16 095
Write events
168
Delete events
32

Modification events

(PID) Process:(5668) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
241600004126CE404EB9DB01
(PID) Process:(5668) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
EC3CA4C3AC4C1EF04AE0ED16543EC6829B35FA206192547ABC97E4D6124E8AD3
(PID) Process:(5668) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10bd97.rbs
Value:
31177038
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10bd97.rbsLow
Value:
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D45F152E5BE7289449F90D588F84BD5D
Operation:writeName:2E4D254C42ED6B845B3CCA2B040A6160
Value:
C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2ED206DB688193B489E86537451F75D7
Operation:writeName:2E4D254C42ED6B845B3CCA2B040A6160
Value:
C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4FEC4D8CE9091D3499C19390B8C387CF
Operation:writeName:2E4D254C42ED6B845B3CCA2B040A6160
Value:
02:\Software\Caphyon\Advanced Installer\LZMA\{C452D4E2-DE24-48B6-B5C3-ACB240A01606}\1.0.0.0\AI_ExePath
(PID) Process:(5668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19FD36884EFA5E041805E77DDE0ABD3B
Operation:writeName:2E4D254C42ED6B845B3CCA2B040A6160
Value:
02:\Software\Windows\{C452D4E2-DE24-48B6-B5C3-ACB240A01606}\AI_IA_ENABLE
Executable files
20
Suspicious files
47
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4436Endermanch@WinlockerVB6Blacksod.exeC:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dllexecutable
MD5:3531CF7755B16D38D5E9E3C43280E7D2
SHA256:76133E832C15AA5CBC49FB3BA09E0B8DD467C307688BE2C9E85E79D3BF62C089
4436Endermanch@WinlockerVB6Blacksod.exeC:\Users\admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msiexecutable
MD5:27BC9540828C59E1CA1997CF04F6C467
SHA256:05C18698C3DC3B2709AFD3355AD5B91A60B2121A52E5FCC474E4E47FB8E95E2A
5668msiexec.exeC:\Windows\Installer\10bd95.msiexecutable
MD5:27BC9540828C59E1CA1997CF04F6C467
SHA256:05C18698C3DC3B2709AFD3355AD5B91A60B2121A52E5FCC474E4E47FB8E95E2A
1280msiexec.exeC:\Users\admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{63A44102-24B4-4646-8917-1625262D5D47}.sessiontext
MD5:E1C8EB678D1CFB531E514470A8B26071
SHA256:7003D7F5734FA69BB9B76CD46C86D48C3879521628A22337FD7AC431EA22AE91
4436Endermanch@WinlockerVB6Blacksod.exeC:\Users\admin\AppData\Local\Temp\shiB558.tmpexecutable
MD5:CE85F5D941EBCA72DA2A55835B303EB9
SHA256:6CF60B8101CBB475F3803E18617172CC180AFA4BC0CA8CA261C2AB6ED1C93EA1
1280msiexec.exeC:\Users\admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.initext
MD5:C089CFD861288A4BEE65EB981A5AF497
SHA256:6532C0A166054582364FB0B13EEC531FBC40D5D63397922999C054A24667199A
5668msiexec.exeC:\Windows\Installer\MSIC026.tmpexecutable
MD5:D552DD4108B5665D306B4A8BD6083DDE
SHA256:A0367875B68B1699D2647A748278EBCE64D5BE633598580977AA126A81CF57C5
5668msiexec.exeC:\Windows\Installer\MSIC085.tmpexecutable
MD5:D552DD4108B5665D306B4A8BD6083DDE
SHA256:A0367875B68B1699D2647A748278EBCE64D5BE633598580977AA126A81CF57C5
5668msiexec.exeC:\Windows\Installer\MSIC619.tmpexecutable
MD5:3CAB78D0DC84883BE2335788D387601E
SHA256:604E79FE970C5ED044517A9A35E4690EA6F7D959D21173EBEF45CDD3D3A22BDD
5668msiexec.exeC:\Windows\Installer\MSIBFF6.tmpexecutable
MD5:4083CB0F45A747D8E8AB0D3E060616F2
SHA256:252B7423B01FF81AEA6FE7B40DE91ABF49F515E9C0C7B95AA982756889F8AC1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
69
DNS requests
25
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
1280
msiexec.exe
POST
404
3.213.169.128:80
http://collect.installeranalytics.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1280
msiexec.exe
3.213.169.128:80
collect.installeranalytics.com
AMAZON-AES
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6564
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.130
  • 20.190.159.129
  • 20.190.159.71
  • 40.126.31.3
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.130
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
collect.installeranalytics.com
  • 3.213.169.128
  • 54.224.212.97
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:c02:2::284
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
1280
msiexec.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] TakeMyFile UA
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Endermanch@WinlockerVB6Blacksod.exe