File name:

US9DW_IMPORTANT.exe

Full analysis: https://app.any.run/tasks/c86d43fa-9815-4e29-831c-4dbb30ed2d0b
Verdict: Malicious activity
Analysis date: May 17, 2025, 01:25:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
auto-startup
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 19 sections
MD5:

2BCE758E24FA1E4EA327146BA190385F

SHA1:

15077ECEFFBD29650C695BE3FCFD1308DB87FB53

SHA256:

772EE224049E016EF16917DF647D32BBDFE01CA17CD049487F943B8A55FF492F

SSDEEP:

49152:20B4zzBEX4kajvGv567PvCrb2I9HG5GsGbvB:2deG5GsGbvB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 4180)

    • Create files in the Startup directory

      • US9DW_IMPORTANT.exe (PID: 6388)

    • Modifies files in the Chrome extension folder

      • US9DW_IMPORTANT.exe (PID: 6388)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Reads the date of Windows installation

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Application launched itself

      • US9DW_IMPORTANT.exe (PID: 6108)
      • US9DW_IMPORTANT.exe (PID: 4000)
      • US9DW_IMPORTANT.exe (PID: 4424)

    • Executable content was dropped or overwritten

      • US9DW_IMPORTANT.exe (PID: 6388)

  • INFO

    • Checks supported languages

      • US9DW_IMPORTANT.exe (PID: 6108)
      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 4180)

    • Reads the computer name

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Process checks computer location settings

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Creates files or folders in the user directory

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6112)

    • Auto-launch of the file from Registry key

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4180)

    • Auto-launch of the file from Startup directory

      • US9DW_IMPORTANT.exe (PID: 6388)

    • Creates files in the program directory

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 728)

    • Reads the machine GUID from the registry

      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 4180)

    • Manual execution by a user

      • US9DW_IMPORTANT.exe (PID: 4000)
      • US9DW_IMPORTANT.exe (PID: 4424)
      • OpenWith.exe (PID: 7280)
      • OpenWith.exe (PID: 6808)
      • OpenWith.exe (PID: 728)
      • OpenWith.exe (PID: 7268)
      • OpenWith.exe (PID: 7020)
      • OpenWith.exe (PID: 5156)
      • OpenWith.exe (PID: 4244)
      • OpenWith.exe (PID: 7312)
      • OpenWith.exe (PID: 7888)
      • OpenWith.exe (PID: 7540)
      • OpenWith.exe (PID: 7856)
      • OpenWith.exe (PID: 7444)
      • OpenWith.exe (PID: 7204)
      • OpenWith.exe (PID: 6004)
      • OpenWith.exe (PID: 7428)
      • OpenWith.exe (PID: 6436)
      • OpenWith.exe (PID: 5964)
      • OpenWith.exe (PID: 7928)
      • OpenWith.exe (PID: 8472)
      • OpenWith.exe (PID: 8200)
      • OpenWith.exe (PID: 8260)
      • OpenWith.exe (PID: 8488)
      • OpenWith.exe (PID: 3300)
      • OpenWith.exe (PID: 7424)
      • OpenWith.exe (PID: 2800)
      • OpenWith.exe (PID: 8496)
      • OpenWith.exe (PID: 8504)
      • OpenWith.exe (PID: 8568)
      • OpenWith.exe (PID: 8800)
      • OpenWith.exe (PID: 8820)
      • OpenWith.exe (PID: 8836)
      • OpenWith.exe (PID: 8928)
      • OpenWith.exe (PID: 9152)
      • OpenWith.exe (PID: 9172)
      • OpenWith.exe (PID: 9180)
      • OpenWith.exe (PID: 7236)
      • OpenWith.exe (PID: 7416)
      • OpenWith.exe (PID: 9252)
      • OpenWith.exe (PID: 9272)
      • OpenWith.exe (PID: 8992)
      • OpenWith.exe (PID: 9188)
      • OpenWith.exe (PID: 10224)
      • OpenWith.exe (PID: 7392)
      • OpenWith.exe (PID: 9628)
      • OpenWith.exe (PID: 10192)
      • OpenWith.exe (PID: 7532)
      • OpenWith.exe (PID: 7848)
      • OpenWith.exe (PID: 8736)
      • OpenWith.exe (PID: 10976)
      • OpenWith.exe (PID: 8716)
      • OpenWith.exe (PID: 8140)
      • OpenWith.exe (PID: 10624)
      • OpenWith.exe (PID: 10988)
      • OpenWith.exe (PID: 9280)
      • OpenWith.exe (PID: 9364)
      • OpenWith.exe (PID: 9380)
      • OpenWith.exe (PID: 9468)
      • OpenWith.exe (PID: 9536)
      • OpenWith.exe (PID: 11032)
      • OpenWith.exe (PID: 11012)
      • OpenWith.exe (PID: 11164)
      • OpenWith.exe (PID: 10376)
      • OpenWith.exe (PID: 10096)
      • OpenWith.exe (PID: 10792)
      • OpenWith.exe (PID: 5428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:17 01:23:02+00:00
ImageFileCharacteristics: Executable, No line numbers, Large address aware
PEType: PE32+
LinkerVersion: 2.41
CodeSize: 859136
InitializedDataSize: 1084416
UninitializedDataSize: 3584
EntryPoint: 0x13e0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
309
Monitored processes
127
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start us9dw_important.exe no specs us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe no specs us9dw_important.exe no specs us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe slui.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs us9dw_important.exe openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs us9dw_important.exe us9dw_important.exe openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
728"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
728"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\higherset.png.encC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1660"C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe" C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1676"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\US9DW_IMPORTANT.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1708"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2064"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2800"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\desktop.ini.enc.encC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2984"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3300"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\individualrequired.png.encC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
295 108
Read events
295 098
Write events
10
Delete events
0

Modification events

(PID) Process:(6388) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(4336) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(6112) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(728) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(4180) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(660) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(5640) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(5384) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(2984) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(5728) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
Executable files
17
Suspicious files
4 043
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6388US9DW_IMPORTANT.exeC:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exeexecutable
MD5:2BCE758E24FA1E4EA327146BA190385F
SHA256:772EE224049E016EF16917DF647D32BBDFE01CA17CD049487F943B8A55FF492F
6388US9DW_IMPORTANT.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\US9DW_IMPORTANT.exeexecutable
MD5:2BCE758E24FA1E4EA327146BA190385F
SHA256:772EE224049E016EF16917DF647D32BBDFE01CA17CD049487F943B8A55FF492F
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\CCleaner.lnk.encbinary
MD5:8FCE03863DDDA3AB10F364D15AA2318F
SHA256:A386AA0AD7E08E446EFFF4746DE94BA90FF7BBFA5E8575ECFB2298F78CE1DDAF
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\Microsoft Edge.lnk.encbinary
MD5:F515BE4DEECB7AA724F316CB7FFD13C5
SHA256:F0338D7A3E7B1FEF4A54D71C6F3DFFD935D6CD0006D7B9C477CC88E7E4C63DA2
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\desktop.ini.encbinary
MD5:7532B2BC0162C2839B2119ED329C4652
SHA256:891588DFA4B0010D84E55DC9A8BBF01DBC785308E9FBA9EEB0143407B921C326
6388US9DW_IMPORTANT.exeC:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml.encbinary
MD5:57E31CF0659F7DEAD58EC5B40F44043B
SHA256:5BE29557AD09B5BDE1A3A36494CC961CB28821E6601348ECC1D2DAD37F6F0B6F
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\Google Chrome.lnk.encbinary
MD5:CD93CF8499F90741BAD3875C3D9F7AF8
SHA256:872ECB18891CF77393B1DA83DD735E48C8C2C56C61C3A112337CA33264692D25
6388US9DW_IMPORTANT.exeC:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.encbinary
MD5:0AD9CF3DEE10CC2B73CBB22C2275B6D0
SHA256:52275207B5A985D1FE159D0FBBBDE07667518FBB4CC2C65E0629E393FB661489
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\Firefox.lnk.encbinary
MD5:371449D1E251C58F1DD502F86FDBB10B
SHA256:21190516E3E6D434E6E2AA5680AC3345CA1818E0A3AAB4992DC0AC26674EAB72
6388US9DW_IMPORTANT.exeC:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.encbinary
MD5:BD06F0CB739D76F5694B9EC1510B0593
SHA256:996995867B016D73107AF496D1EA2FFD80EE8432D70A352777B1516ECDDAD62A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
39
DNS requests
21
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7460
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7460
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6480
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.14
  • 20.190.160.130
  • 40.126.32.76
  • 20.190.160.132
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
US9DW_IMPORTANT.exe