File name:

US9DW_IMPORTANT.exe

Full analysis: https://app.any.run/tasks/c86d43fa-9815-4e29-831c-4dbb30ed2d0b
Verdict: Malicious activity
Analysis date: May 17, 2025, 01:25:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
auto-startup
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 19 sections
MD5:

2BCE758E24FA1E4EA327146BA190385F

SHA1:

15077ECEFFBD29650C695BE3FCFD1308DB87FB53

SHA256:

772EE224049E016EF16917DF647D32BBDFE01CA17CD049487F943B8A55FF492F

SSDEEP:

49152:20B4zzBEX4kajvGv567PvCrb2I9HG5GsGbvB:2deG5GsGbvB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 4180)
      • US9DW_IMPORTANT.exe (PID: 728)

    • Create files in the Startup directory

      • US9DW_IMPORTANT.exe (PID: 6388)

    • Modifies files in the Chrome extension folder

      • US9DW_IMPORTANT.exe (PID: 6388)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Application launched itself

      • US9DW_IMPORTANT.exe (PID: 6108)
      • US9DW_IMPORTANT.exe (PID: 4424)
      • US9DW_IMPORTANT.exe (PID: 4000)

    • Executable content was dropped or overwritten

      • US9DW_IMPORTANT.exe (PID: 6388)

    • Reads the date of Windows installation

      • US9DW_IMPORTANT.exe (PID: 6108)

  • INFO

    • Reads the computer name

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Creates files or folders in the user directory

      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 6112)

    • Process checks computer location settings

      • US9DW_IMPORTANT.exe (PID: 6108)

    • Auto-launch of the file from Registry key

      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4180)

    • Checks supported languages

      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6108)
      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4180)
      • US9DW_IMPORTANT.exe (PID: 6112)

    • Reads the machine GUID from the registry

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 728)
      • US9DW_IMPORTANT.exe (PID: 4180)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6112)

    • Creates files in the program directory

      • US9DW_IMPORTANT.exe (PID: 6388)
      • US9DW_IMPORTANT.exe (PID: 4336)
      • US9DW_IMPORTANT.exe (PID: 6112)
      • US9DW_IMPORTANT.exe (PID: 728)

    • Auto-launch of the file from Startup directory

      • US9DW_IMPORTANT.exe (PID: 6388)

    • Manual execution by a user

      • OpenWith.exe (PID: 728)
      • OpenWith.exe (PID: 7312)
      • OpenWith.exe (PID: 7280)
      • OpenWith.exe (PID: 7424)
      • OpenWith.exe (PID: 5428)
      • OpenWith.exe (PID: 3300)
      • OpenWith.exe (PID: 2800)
      • US9DW_IMPORTANT.exe (PID: 4424)
      • US9DW_IMPORTANT.exe (PID: 4000)
      • OpenWith.exe (PID: 6808)
      • OpenWith.exe (PID: 7268)
      • OpenWith.exe (PID: 7020)
      • OpenWith.exe (PID: 5156)
      • OpenWith.exe (PID: 7204)
      • OpenWith.exe (PID: 7428)
      • OpenWith.exe (PID: 6436)
      • OpenWith.exe (PID: 7928)
      • OpenWith.exe (PID: 5964)
      • OpenWith.exe (PID: 8568)
      • OpenWith.exe (PID: 6004)
      • OpenWith.exe (PID: 8200)
      • OpenWith.exe (PID: 8472)
      • OpenWith.exe (PID: 8488)
      • OpenWith.exe (PID: 8496)
      • OpenWith.exe (PID: 8504)
      • OpenWith.exe (PID: 7888)
      • OpenWith.exe (PID: 7856)
      • OpenWith.exe (PID: 7540)
      • OpenWith.exe (PID: 4244)
      • OpenWith.exe (PID: 7444)
      • OpenWith.exe (PID: 8260)
      • OpenWith.exe (PID: 8928)
      • OpenWith.exe (PID: 8992)
      • OpenWith.exe (PID: 9252)
      • OpenWith.exe (PID: 9152)
      • OpenWith.exe (PID: 9172)
      • OpenWith.exe (PID: 7236)
      • OpenWith.exe (PID: 9188)
      • OpenWith.exe (PID: 9280)
      • OpenWith.exe (PID: 7416)
      • OpenWith.exe (PID: 9272)
      • OpenWith.exe (PID: 9364)
      • OpenWith.exe (PID: 9380)
      • OpenWith.exe (PID: 9468)
      • OpenWith.exe (PID: 9536)
      • OpenWith.exe (PID: 8800)
      • OpenWith.exe (PID: 8820)
      • OpenWith.exe (PID: 8836)
      • OpenWith.exe (PID: 9180)
      • OpenWith.exe (PID: 7848)
      • OpenWith.exe (PID: 8736)
      • OpenWith.exe (PID: 8140)
      • OpenWith.exe (PID: 10624)
      • OpenWith.exe (PID: 7392)
      • OpenWith.exe (PID: 10988)
      • OpenWith.exe (PID: 10976)
      • OpenWith.exe (PID: 9628)
      • OpenWith.exe (PID: 10192)
      • OpenWith.exe (PID: 10224)
      • OpenWith.exe (PID: 7532)
      • OpenWith.exe (PID: 8716)
      • OpenWith.exe (PID: 10376)
      • OpenWith.exe (PID: 11164)
      • OpenWith.exe (PID: 11032)
      • OpenWith.exe (PID: 11012)
      • OpenWith.exe (PID: 10096)
      • OpenWith.exe (PID: 10792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:17 01:23:02+00:00
ImageFileCharacteristics: Executable, No line numbers, Large address aware
PEType: PE32+
LinkerVersion: 2.41
CodeSize: 859136
InitializedDataSize: 1084416
UninitializedDataSize: 3584
EntryPoint: 0x13e0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
309
Monitored processes
127
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start us9dw_important.exe no specs us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe no specs us9dw_important.exe no specs us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe slui.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs us9dw_important.exe openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs us9dw_important.exe openwith.exe no specs openwith.exe no specs us9dw_important.exe us9dw_important.exe openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
728"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
728"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\higherset.png.encC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1660"C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe" C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1676"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\US9DW_IMPORTANT.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1708"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2064"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2800"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\desktop.ini.enc.encC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2984"C:\Users\admin\Desktop\US9DW_IMPORTANT.exe" C:\Users\admin\Desktop\US9DW_IMPORTANT.exe
US9DW_IMPORTANT.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\us9dw_important.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3300"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\individualrequired.png.encC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
295 108
Read events
295 098
Write events
10
Delete events
0

Modification events

(PID) Process:(6388) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(4336) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(6112) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(728) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(4180) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(660) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(5640) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(5384) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(2984) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
(PID) Process:(5728) US9DW_IMPORTANT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MyClone
Value:
C:\Users\admin\AppData\Roaming\US9DW_IMPORTANT.exe
Executable files
17
Suspicious files
4 043
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\Adobe Acrobat.lnk.encbinary
MD5:D03C3878E047D263EB4B2F82EE2D24A1
SHA256:DA30B32A4C6B019737F644DBE6682974600689A3CE2BC3515BF58F837DCB9036
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\CCleaner.lnk.encbinary
MD5:8FCE03863DDDA3AB10F364D15AA2318F
SHA256:A386AA0AD7E08E446EFFF4746DE94BA90FF7BBFA5E8575ECFB2298F78CE1DDAF
6388US9DW_IMPORTANT.exeC:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.encbinary
MD5:BD06F0CB739D76F5694B9EC1510B0593
SHA256:996995867B016D73107AF496D1EA2FFD80EE8432D70A352777B1516ECDDAD62A
6388US9DW_IMPORTANT.exeC:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.encbinary
MD5:2F12FED9BCD2C1C6C260B71EFEA803F6
SHA256:1E317493D18E20B156B18C4274B4DE4D76D92374F683CEEE858FEC8BCE2832A7
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\Google Chrome.lnk.encbinary
MD5:CD93CF8499F90741BAD3875C3D9F7AF8
SHA256:872ECB18891CF77393B1DA83DD735E48C8C2C56C61C3A112337CA33264692D25
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\desktop.ini.encbinary
MD5:7532B2BC0162C2839B2119ED329C4652
SHA256:891588DFA4B0010D84E55DC9A8BBF01DBC785308E9FBA9EEB0143407B921C326
6388US9DW_IMPORTANT.exeC:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.encbinary
MD5:0C6D2752771896DD3357F2EB4A9279CA
SHA256:15EF38755CA388EB10861738572CC145ACB4CE6A63C32A8A757A9B920A1FA2C7
6388US9DW_IMPORTANT.exeC:\Users\Public\Desktop\VLC media player.lnk.encbinary
MD5:2D0B725AF3E9211A29DF39EF84CA0D8F
SHA256:6C9589F1F9B148CDCF91B10ACBDBC9B038B370E28EA28FF1C20611BC67E4D57A
6388US9DW_IMPORTANT.exeC:\Users\Public\Downloads\desktop.ini.encbinary
MD5:4154DF512EDAE9F3E2E121F70E945E2A
SHA256:C10A2BCB5D9AB49781ADAC266D124A497940A2AAF4210868C549E764F4547623
6388US9DW_IMPORTANT.exeC:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.encbinary
MD5:A6035C9357DB41DF41244C603BDCE511
SHA256:B3D1ED8B49CAA66039A529E9CA5AC3DE212BCB68BFA2E8F5AF665A0E1FEF3D7A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
39
DNS requests
21
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7460
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7460
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6480
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.14
  • 20.190.160.130
  • 40.126.32.76
  • 20.190.160.132
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
US9DW_IMPORTANT.exe