download:

/Brandon-Everhart/Practical-Malware-Analysis/raw/refs/heads/master/PracticalMalwareAnalysis-Labs.exe

Full analysis: https://app.any.run/tasks/c2d7474c-a7a1-47b0-a53d-8302125a16f9
Verdict: Malicious activity
Analysis date: March 24, 2025, 14:38:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 5 sections
MD5:

9D9C90870BC46AD65BAF0F3977E7590F

SHA1:

DEC5842D07BBD00EDF564FE27C14118EC9ECC77F

SHA256:

704138BEC89CF9E7F00FBCE100DBC09CF133D16DC0203806392F0E153C43C68C

SSDEEP:

24576:uxaVxr53s2QByK9VHFsZ+Ykyxm7g8LVYD/rh6m6er9wgwGe66hXS:u6QXHFsrxKY70neru/66dS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 3192)
      • net.exe (PID: 6036)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Reads security settings of Internet Explorer

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Drops a system driver (possible attempt to evade defenses)

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Reads Internet Explorer settings

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Executable content was dropped or overwritten

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)
      • Lab11-01.exe (PID: 8164)

    • There is functionality for taking screenshot (YARA)

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Process drops legitimate windows executable

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Starts CMD.EXE for commands execution

      • Lab11-03.exe (PID: 8000)

  • INFO

    • Checks supported languages

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Checks proxy server information

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Reads the computer name

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • The sample compiled with english language support

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • The sample compiled with chinese language support

      • PracticalMalwareAnalysis-Labs.exe (PID: 5332)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 456)
      • BackgroundTransferHost.exe (PID: 7624)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 456)

    • Manual execution by a user

      • Lab11-01.exe (PID: 8164)
      • Lab11-03.exe (PID: 8000)
      • Lab12-04.exe (PID: 7052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:01:09 13:44:06+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 72704
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0xb3c1
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
19
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start practicalmalwareanalysis-labs.exe sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs rundll32.exe no specs lab11-01.exe conhost.exe no specs lab11-03.exe no specs conhost.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs lab12-04.exe no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1128C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3192C:\WINDOWS\system32\cmd.exe /c net start cisvcC:\Windows\SysWOW64\cmd.exe—Lab11-03.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4448\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Lab11-03.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5332"C:\Users\admin\Downloads\PracticalMalwareAnalysis-Labs.exe" C:\Users\admin\Downloads\PracticalMalwareAnalysis-Labs.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\practicalmalwareanalysis-labs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5720"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6036net start cisvcC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6048C:\WINDOWS\system32\net1 start cisvcC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
6800"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7052"C:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-04.exe" C:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-04.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\downloads\practical malware analysis labs\binarycollection\chapter_12l\lab12-04.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
2 682
Read events
2 661
Write events
21
Delete events
0

Modification events

(PID) Process:(5332) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5332) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5332) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(456) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(456) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(456) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
66
Suspicious files
10
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-03.exeexecutable
MD5:F72D773F13CEB6B842A9D29C56F8880F
SHA256:D66E15EEA51EBD4BFD13F8C97646253740B1E6A99328D22232FD01AE13EF5D05
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-01.exeexecutable
MD5:795F093A536F118FB4C34FCEDFA42165
SHA256:E55CFA92ACC2FAC8B3B41002EBBEF343BFDB61ABF876E9C713F323E143D5E451
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-03.dllexecutable
MD5:BBD65FCAD68E5A3CD1457E2EE05D1F2E
SHA256:F11FA868AC3DEE1E5FBD985FE15BA6D34C7EC0ABB47BABE0D34A35514C49C86A
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-02.exeexecutable
MD5:E2BF42217A67E46433DA8B6F4507219E
SHA256:AE8A1C7EB64C42EA2A04F97523EBF0844C27029EB040D910048B680F884B9DCE
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_13L\Lab13-03.exeexecutable
MD5:98EA0FE0594F0F373D9791886A01DB8C
SHA256:86054002565C929215B82615477652D24379B9119BC33EF7F41706EE7E125379
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-03.exeexecutable
MD5:18EC5BECFA3991FB654E105BAFBD5A4B
SHA256:BF023FF344EFE2DB0E0A963869368F0EF352764666BC368AD61B7A4C1D9F5975
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-01.exeexecutable
MD5:A9C55BB87A7C5C3C923C4FA12940E719
SHA256:57D8D248A8741176348B5D12DCF29F34C8F48EDE0CA13C30D12E5BA0384056D7
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_13L\Lab13-01.exeexecutable
MD5:A9A2734D080E3AE0F5ADA35E878DA7C8
SHA256:71A295247BA7419F9F9DEA8098E6867182BB80F53C98EB0F59192A6557A51249
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_13L\Lab13-02.exeexecutable
MD5:B65C4D7CBC4069DDBFF665370201E588
SHA256:598F21F1E6F4D5829BA8CFBA19D361E09DE510493DF8472A605F46DBF7927030
5332PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Downloads\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-03.exeexecutable
MD5:A7F21E412022554D187D6A876A3C08AC
SHA256:9B683D2FDA7CA7ADCC043E4412271009A0E115CA55F9A718C385A3F46B57AE6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7228
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7228
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
456
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7280
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4220
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7280
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7280
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
456
BackgroundTransferHost.exe
92.123.104.37:443
www.bing.com
Akamai International B.V.
DE
whitelisted
456
BackgroundTransferHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.3
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.66
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 92.123.104.37
  • 92.123.104.46
  • 92.123.104.47
  • 92.123.104.41
  • 92.123.104.44
  • 92.123.104.38
  • 92.123.104.34
  • 92.123.104.42
  • 92.123.104.36
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/Brandon-Everhart/Practical-Malware-Analysis/raw/refs/heads/master/PracticalMalwareAnalysis-Labs.exe