File name:

1 (397)

Full analysis: https://app.any.run/tasks/15d0d4ba-1b69-4cc6-a6bd-30f05667d63c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 19:32:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
downloadassistant
adware
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

8B7A5F641FE9B73E1BACC9BD0295B230

SHA1:

6501682E425E5CB254406476EAB8A0AD7C06DF24

SHA256:

8A02FD7913120A52A6AF4AF1CAB36579D69F9B56092BA42CA050D0CE7FE6DEAF

SSDEEP:

98304:A3Q0/OqZH+yWx2feac3dDFMT10e7Q8F5ffFPg3jiwvZNH9jx0791XdF2iINQg5ct:2/uUcFjAO+bmM4XDyhWy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DOWNLOADASSISTANT mutex has been found

      • searchfiles.exe (PID: 1244)

    • ADWARE has been detected (SURICATA)

      • searchfiles.exe (PID: 1244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (397).exe (PID: 5588)
      • 1 (397).exe (PID: 6768)
      • 1 (397).tmp (PID: 3888)

    • Reads security settings of Internet Explorer

      • 1 (397).tmp (PID: 6744)

    • Reads the Windows owner or organization settings

      • 1 (397).tmp (PID: 3888)

    • Process drops legitimate windows executable

      • 1 (397).tmp (PID: 3888)

    • Executes application which crashes

      • searchfiles.exe (PID: 1244)

    • Access to an unwanted program domain was detected

      • searchfiles.exe (PID: 1244)

    • The process drops C-runtime libraries

      • 1 (397).tmp (PID: 3888)

  • INFO

    • Create files in a temporary directory

      • 1 (397).exe (PID: 5588)
      • 1 (397).exe (PID: 6768)
      • 1 (397).tmp (PID: 3888)

    • Reads the computer name

      • 1 (397).tmp (PID: 6744)
      • 1 (397).tmp (PID: 3888)
      • searchfiles.exe (PID: 1244)

    • Checks supported languages

      • 1 (397).exe (PID: 5588)
      • 1 (397).tmp (PID: 6744)
      • 1 (397).exe (PID: 6768)
      • 1 (397).tmp (PID: 3888)
      • searchfiles.exe (PID: 1244)

    • Process checks computer location settings

      • 1 (397).tmp (PID: 6744)

    • The sample compiled with english language support

      • 1 (397).tmp (PID: 3888)

    • Creates a software uninstall entry

      • 1 (397).tmp (PID: 3888)

    • Creates files or folders in the user directory

      • 1 (397).tmp (PID: 3888)
      • WerFault.exe (PID: 5556)
      • WerFault.exe (PID: 616)
      • WerFault.exe (PID: 300)
      • WerFault.exe (PID: 7272)
      • WerFault.exe (PID: 3268)
      • WerFault.exe (PID: 7652)
      • WerFault.exe (PID: 7736)
      • WerFault.exe (PID: 7344)
      • WerFault.exe (PID: 7464)
      • BackgroundTransferHost.exe (PID: 8008)
      • WerFault.exe (PID: 7584)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7800)
      • BackgroundTransferHost.exe (PID: 8008)
      • BackgroundTransferHost.exe (PID: 8180)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8008)

    • Detects InnoSetup installer (YARA)

      • 1 (397).exe (PID: 5588)
      • 1 (397).tmp (PID: 3888)
      • 1 (397).tmp (PID: 6744)
      • 1 (397).exe (PID: 6768)

    • Compiled with Borland Delphi (YARA)

      • 1 (397).exe (PID: 5588)
      • 1 (397).tmp (PID: 3888)
      • 1 (397).tmp (PID: 6744)
      • 1 (397).exe (PID: 6768)
      • searchfiles.exe (PID: 1244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:07 12:39:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37376
InitializedDataSize: 17408
UninitializedDataSize: -
EntryPoint: 0x9a58
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: SearchFiles Setup
FileVersion:
LegalCopyright:
ProductName: SearchFiles
ProductVersion:
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
23
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 1 (397).exe 1 (397).tmp no specs 1 (397).exe 1 (397).tmp #DOWNLOADASSISTANT searchfiles.exe werfault.exe no specs svchost.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs werfault.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1244 -s 1012C:\Windows\SysWOW64\WerFault.exe—searchfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
616C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1244 -s 904C:\Windows\SysWOW64\WerFault.exe—searchfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1244"C:\Users\admin\AppData\Local\SearchFiles 3.31\searchfiles.exe" 9bcb531170419d3b3eb7bbf3647ba815C:\Users\admin\AppData\Local\SearchFiles 3.31\searchfiles.exe
1 (397).tmp
User:
admin
Integrity Level:
HIGH
Version:
8.4.10.1
Modules
Images
c:\users\admin\appdata\local\searchfiles 3.31\searchfiles.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3008"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3268C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1244 -s 1056C:\Windows\SysWOW64\WerFault.exe—searchfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3888"C:\Users\admin\AppData\Local\Temp\is-LQ96U.tmp\1 (397).tmp" /SL5="$40308,7347787,53248,C:\Users\admin\AppData\Local\Temp\1 (397).exe" /SPAWNWND=$402DA /NOTIFYWND=$902AE C:\Users\admin\AppData\Local\Temp\is-LQ96U.tmp\1 (397).tmp
1 (397).exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-lq96u.tmp\1 (397).tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5556C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1244 -s 896C:\Windows\SysWOW64\WerFault.exe—searchfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5588"C:\Users\admin\AppData\Local\Temp\1 (397).exe" C:\Users\admin\AppData\Local\Temp\1 (397).exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
SearchFiles Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\1 (397).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6744"C:\Users\admin\AppData\Local\Temp\is-5E3IN.tmp\1 (397).tmp" /SL5="$902AE,7347787,53248,C:\Users\admin\AppData\Local\Temp\1 (397).exe" C:\Users\admin\AppData\Local\Temp\is-5E3IN.tmp\1 (397).tmp—1 (397).exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-5e3in.tmp\1 (397).tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
20 999
Read events
20 888
Write events
78
Delete events
33

Modification events

(PID) Process:(5556) WerFault.exeKey:\REGISTRY\A\{c7adf9f0-c151-2871-4b93-13d0137aebc9}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(5556) WerFault.exeKey:\REGISTRY\A\{c7adf9f0-c151-2871-4b93-13d0137aebc9}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.2.3
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\SearchFiles 3.31
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\SearchFiles 3.31\
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:DisplayName
Value:
SearchFiles 3.31
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\SearchFiles 3.31\uninstall\unins000.exe"
(PID) Process:(3888) 1 (397).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchFiles_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\SearchFiles 3.31\uninstall\unins000.exe" /SILENT
Executable files
30
Suspicious files
40
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
67681 (397).exeC:\Users\admin\AppData\Local\Temp\is-LQ96U.tmp\1 (397).tmpexecutable
MD5:EB7FC4F84667BD0EC3E4A5C5AAA64B49
SHA256:FF2D894C60FA6EAA307AD26060495F8B7B650E4CE9CE19020147EB44D7A811B4
38881 (397).tmpC:\Users\admin\AppData\Local\Temp\is-2CTA4.tmp\_isetup\_RegDLL.tmpexecutable
MD5:C594B792B9C556EA62A30DE541D2FB03
SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
55881 (397).exeC:\Users\admin\AppData\Local\Temp\is-5E3IN.tmp\1 (397).tmpexecutable
MD5:EB7FC4F84667BD0EC3E4A5C5AAA64B49
SHA256:FF2D894C60FA6EAA307AD26060495F8B7B650E4CE9CE19020147EB44D7A811B4
38881 (397).tmpC:\Users\admin\AppData\Local\Temp\is-2CTA4.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
38881 (397).tmpC:\Users\admin\AppData\Local\SearchFiles 3.31\uninstall\unins000.exeexecutable
MD5:CAD8D0DB0585CE3897D53ECE156ED23B
SHA256:80B1D305A4FAF62B228A46D744E44E445F2A4C18B0FE333479334B1660B7107C
38881 (397).tmpC:\Users\admin\AppData\Local\Temp\is-2CTA4.tmp\_isetup\_setup64.tmpexecutable
MD5:B4604F8CD050D7933012AE4AA98E1796
SHA256:B50B7AC03EC6DA865BF4504C7AC1E52D9F5B67C7BCB3EC0DB59FAB24F1B471C5
38881 (397).tmpC:\Users\admin\AppData\Local\SearchFiles 3.31\uninstall\is-V38D1.tmpexecutable
MD5:CAD8D0DB0585CE3897D53ECE156ED23B
SHA256:80B1D305A4FAF62B228A46D744E44E445F2A4C18B0FE333479334B1660B7107C
38881 (397).tmpC:\Users\admin\AppData\Local\SearchFiles 3.31\is-K8BDS.tmpexecutable
MD5:A7F201C0B9AC05E950ECC55D4403EC16
SHA256:173092C4E256958B100683A6AB2CE0D1C9895EC63F222198F9DE485E61C728CA
38881 (397).tmpC:\Users\admin\AppData\Local\SearchFiles 3.31\libGLESv2.dllexecutable
MD5:A73EE126B2E6D43182D4C3482899D338
SHA256:06BBE605D7B0EF044871633B496948A8D65C78661E457D0844DC434A0609F763
38881 (397).tmpC:\Users\admin\AppData\Local\SearchFiles 3.31\is-S6SD9.tmpexecutable
MD5:DAE4100039A943128C34BA3E05F6CD02
SHA256:2357806CA24C9D3152D54D34270810DA9D9CA943462EBF7291AE06A10E5CB8BA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
18
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1244
searchfiles.exe
POST
—
104.21.48.1:80
http://start7345724.ru/new/net_api
unknown
—
—
unknown
7892
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1244
searchfiles.exe
POST
—
104.21.48.1:80
http://start7345724.ru/new/net_api
unknown
—
—
unknown
6388
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7892
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8008
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1244
searchfiles.exe
104.21.48.1:80
start7345724.ru
CLOUDFLARENET
—
unknown
6388
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.143
  • 23.48.23.176
  • 23.48.23.145
  • 23.48.23.150
  • 23.48.23.173
  • 23.48.23.162
  • 23.48.23.169
  • 23.48.23.180
whitelisted
start7345724.ru
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.96.1
unknown
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.14
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (start7345724 .ru)
1244
searchfiles.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] DownloadAssistant HTTP POST Request
1244
searchfiles.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] DownloadAssistant HTTP POST Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (397)