URL:

https://www.stremio.com/

Full analysis: https://app.any.run/tasks/5b5fc9bf-d2ed-489a-8571-6acf5a89b02b
Verdict: Malicious activity
Analysis date: February 13, 2025, 14:09:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MD5:

C48A7E7632695FEE04409139E42217C8

SHA1:

708CD71205301F6D59FAFE7800446C8381B946C7

SHA256:

7058A6D48706C9D7887C5FF54CE4307001F78022797F09B43ACEFC30538AF3C8

SSDEEP:

3:N8DSLLG:2OLLG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Stremio+4.4.168.exe (PID: 720)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Stremio+4.4.168.exe (PID: 720)

    • The process drops C-runtime libraries

      • Stremio+4.4.168.exe (PID: 720)

    • Detected use of alternative data streams (AltDS)

      • stremio.exe (PID: 1292)

    • Executable content was dropped or overwritten

      • Stremio+4.4.168.exe (PID: 720)

    • There is functionality for taking screenshot (YARA)

      • Stremio+4.4.168.exe (PID: 720)
      • stremio.exe (PID: 1292)

    • Creates a software uninstall entry

      • Stremio+4.4.168.exe (PID: 720)

    • The process creates files with name similar to system file names

      • Stremio+4.4.168.exe (PID: 720)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 3936)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 7824)

    • Starts CMD.EXE for commands execution

      • stremio-runtime.exe (PID: 6308)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1864)
      • cmd.exe (PID: 7568)
      • cmd.exe (PID: 444)

  • INFO

    • Creates files or folders in the user directory

      • Stremio+4.4.168.exe (PID: 720)
      • QtWebEngineProcess.exe (PID: 7704)
      • stremio-runtime.exe (PID: 6308)
      • stremio.exe (PID: 1292)

    • Checks supported languages

      • stremio.exe (PID: 1292)
      • identity_helper.exe (PID: 8064)
      • Stremio+4.4.168.exe (PID: 720)
      • stremio-runtime.exe (PID: 6308)
      • QtWebEngineProcess.exe (PID: 7704)
      • QtWebEngineProcess.exe (PID: 4128)
      • ffmpeg.exe (PID: 7616)
      • ffprobe.exe (PID: 7620)
      • ffmpeg.exe (PID: 4640)
      • ffmpeg.exe (PID: 1328)

    • Reads Environment values

      • identity_helper.exe (PID: 8064)

    • Reads the computer name

      • stremio.exe (PID: 1292)
      • identity_helper.exe (PID: 8064)
      • Stremio+4.4.168.exe (PID: 720)
      • QtWebEngineProcess.exe (PID: 7704)
      • QtWebEngineProcess.exe (PID: 4128)
      • stremio-runtime.exe (PID: 6308)
      • ffmpeg.exe (PID: 4640)
      • ffmpeg.exe (PID: 7616)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6348)

    • The sample compiled with english language support

      • Stremio+4.4.168.exe (PID: 720)

    • Create files in a temporary directory

      • Stremio+4.4.168.exe (PID: 720)

    • Reads the machine GUID from the registry

      • stremio.exe (PID: 1292)
      • QtWebEngineProcess.exe (PID: 7704)

    • Process checks computer location settings

      • QtWebEngineProcess.exe (PID: 4128)
      • stremio-runtime.exe (PID: 6308)

    • Checks proxy server information

      • QtWebEngineProcess.exe (PID: 7704)
      • stremio.exe (PID: 1292)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3608)
      • WMIC.exe (PID: 5488)
      • WMIC.exe (PID: 7104)

    • Application launched itself

      • msedge.exe (PID: 6348)

    • Reads CPU info

      • stremio-runtime.exe (PID: 6308)

    • Reads the software policy settings

      • QtWebEngineProcess.exe (PID: 7704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
82
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs stremio+4.4.168.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs stremio.exe stremio-runtime.exe conhost.exe no specs qtwebengineprocess.exe no specs qtwebengineprocess.exe ffprobe.exe no specs ffmpeg.exe no specs cmd.exe no specs ffmpeg.exe no specs taskkill.exe no specs cmd.exe no specs ffmpeg.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe msedge.exe no specs cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /pid 1328 /T /F"C:\Windows\SysWOW64\cmd.exe—stremio-runtime.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
720"C:\Users\admin\Downloads\Stremio+4.4.168.exe" C:\Users\admin\Downloads\Stremio+4.4.168.exe
msedge.exe
User:
admin
Company:
Smart Code Ltd
Integrity Level:
MEDIUM
Description:
Stremio 4.4.168 Installer
Exit code:
0
Version:
4.4.168
Modules
Images
c:\users\admin\downloads\stremio+4.4.168.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
828"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7080 --field-trial-handle=2308,i,16786584449609297104,7765716847494799691,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1292"C:\Users\admin\AppData\Local\Programs\LNV\Stremio-4\stremio.exe"C:\Users\admin\AppData\Local\Programs\LNV\Stremio-4\stremio.exe
Stremio+4.4.168.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\programs\lnv\stremio-4\stremio.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1296taskkill /pid 1328 /T /FC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
1328C:\Users\admin\AppData\Local\Programs\LNV\Stremio-4\ffmpeg.exe -init_hw_device cuda=cu:0 -filter_hw_device cu -hwaccel cuda -hwaccel_output_format cuda -threads 1 -fflags +genpts -noaccurate_seek -seek_timestamp 1 -copyts -seek2any 1 -i http://127.0.0.1:11470/samples/hevc.mkv -threads 3 -max_muxing_queue_size 2048 -ignore_unknown -map_metadata -1 -map_chapters -1 -map -0:d? -map -0:t? -map v:0 -vf setparams=color_primaries=bt709:color_trc=bt709:colorspace=bt709,scale_cuda=1200:-2:format=yuv420p -c:v h264_nvenc -preset:v p1 -profile:v high -tune:v ull -vsync cfr -r:v 24 -sc_threshold 0 -g 96 -keyint_min 96 -b:v 5242880 -maxrate 5242880 -bufsize 10485760 -map -0:a? -map -0:s? -frag_duration 4000000 -movflags frag_keyframe+empty_moov+default_base_moof+delay_moov+dash -use_editlist 1 -f mp4 pipe:1C:\Users\admin\AppData\Local\Programs\LNV\Stremio-4\ffmpeg.exe—stremio-runtime.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
1400"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.netflix.com/watch/81396545C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—stremio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6724 --field-trial-handle=2308,i,16786584449609297104,7765716847494799691,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5828 --field-trial-handle=2308,i,16786584449609297104,7765716847494799691,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1864C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /pid 4640 /T /F"C:\Windows\SysWOW64\cmd.exe—stremio-runtime.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Total events
24 366
Read events
24 312
Write events
54
Delete events
0

Modification events

(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6348) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
3AF06FE49C8C2F00
(PID) Process:(6348) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
CB9590E49C8C2F00
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393896
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C9B1DDBC-F273-4BEE-A857-2CC6566AD33A}
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393896
Operation:writeName:WindowTabManagerFileMappingId
Value:
{A5584297-A3EE-4686-A363-BFAFAA3508E1}
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393896
Operation:writeName:WindowTabManagerFileMappingId
Value:
{4EDA9005-E474-4370-BB49-DB569A8529E7}
(PID) Process:(6348) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\393896
Operation:writeName:WindowTabManagerFileMappingId
Value:
{E8646167-BDAA-41D3-B482-4F64560623D2}
Executable files
134
Suspicious files
963
Text files
718
Unknown types
0

Dropped files

PID
Process
Filename
Type
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF137429.TMP —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF137429.TMP —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF137429.TMP —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF137439.TMP —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF137439.TMP —
MD5:—
SHA256:—
6348msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
70
TCP/UDP connections
252
DNS requests
212
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2220
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4840
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7608
backgroundTaskHost.exe
GET
200
104.75.232.13:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4840
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
104.75.232.13:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6324
svchost.exe
HEAD
200
2.19.11.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1739989313&P2=404&P3=2&P4=Lq%2bzDrgdI40Nz%2f1THLxCtrO%2fxRbPZqBnG4BxrnBPSbChSDrA2T9UxVZTfeTHPFwYxGy%2fwaTv9ExyzVYLbwCANA%3d%3d
unknown
—
—
whitelisted
6324
svchost.exe
GET
206
2.19.11.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1739989313&P2=404&P3=2&P4=Lq%2bzDrgdI40Nz%2f1THLxCtrO%2fxRbPZqBnG4BxrnBPSbChSDrA2T9UxVZTfeTHPFwYxGy%2fwaTv9ExyzVYLbwCANA%3d%3d
unknown
—
—
whitelisted
6324
svchost.exe
GET
206
2.19.11.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1739989313&P2=404&P3=2&P4=Lq%2bzDrgdI40Nz%2f1THLxCtrO%2fxRbPZqBnG4BxrnBPSbChSDrA2T9UxVZTfeTHPFwYxGy%2fwaTv9ExyzVYLbwCANA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
184.86.251.12:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2220
svchost.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2220
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5472
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6348
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6688
msedge.exe
104.17.24.14:443
cdnjs.cloudflare.com
—
—
whitelisted
6688
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 184.86.251.12
  • 184.86.251.22
  • 184.86.251.15
  • 184.86.251.16
  • 184.86.251.18
  • 184.86.251.10
  • 184.86.251.24
  • 184.86.251.9
  • 184.86.251.20
  • 184.86.251.7
  • 184.86.251.27
  • 184.86.251.11
  • 184.86.251.29
  • 184.86.251.5
  • 184.86.251.30
  • 184.86.251.4
  • 184.86.251.28
  • 184.86.251.25
  • 184.86.251.26
  • 184.86.251.31
  • 184.86.251.21
  • 184.86.251.14
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.stremio.com
  • 104.16.203.97
  • 104.16.204.97
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

PID
Process
Class
Message
6688
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6688
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6688
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6688
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image Sharing Service (imgur.com)
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
Process
Message
stremio.exe
WebEngineContext used before QtWebEngine::initialize() or OpenGL context creation failed.
stremio.exe
qml: Loading web UI from URL: https://app.strem.io/shell-v4.4/#?loginFlow=desktop
stremio.exe
qml: Stremio Shell version: 4.4.168
stremio.exe
qml: **** Completed. Loading Autoupdater ***
stremio.exe
qml: Auto-updater: checking for new version
stremio.exe
qml: Auto-updater: up to date
stremio.exe
Successful to enable/disable screen saver (enabled: 0)
stremio.exe
js: [object Object]
stremio.exe
js: [object Object]
stremio.exe
Successful to enable/disable screen saver (enabled: 1)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.stremio.com/