URL:

data.exloader.net/ExLoader_Installer.exe

Full analysis: https://app.any.run/tasks/41704481-c21a-4107-9495-efc4eb40b3fe
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 01, 2026, 16:24:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
stealer
Indicators:
MD5:

4B3FE8924D8BBC8855434B10328919AC

SHA1:

09A8E914531B3D592248E89645B604170042758B

SHA256:

8B6CFA5859803ACB651D6A3538BBBEA4F0F8B7297B628232E51C6D681AFF952A

SSDEEP:

3:QAvEBySBXLNn:qtXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • ExLoader_Installer.exe (PID: 8180)

    • Changes Windows Defender settings

      • ExLoader_Installer.exe (PID: 8180)

    • Actions looks like stealing of personal data

      • ExLoader_Installer.exe (PID: 8180)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ExLoader_Installer.exe (PID: 7648)
      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 3656)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Reads the Windows owner or organization settings

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 3656)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Starts POWERSHELL.EXE for commands execution

      • ExLoader_Installer.exe (PID: 8180)

    • Executable content was dropped or overwritten

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)

    • Script adds exclusion path to Windows Defender

      • ExLoader_Installer.exe (PID: 8180)

    • Starts itself from another location

      • ExLoader.exe (PID: 5504)
      • ExLoader.exe (PID: 6336)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 8960)

    • Checks supported languages

      • identity_helper.exe (PID: 8380)
      • ExLoader_Installer.exe (PID: 7648)
      • ExLoader_Installer.exe (PID: 8180)
      • constantgeneral.exe (PID: 3656)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Reads the computer name

      • identity_helper.exe (PID: 8380)
      • ExLoader_Installer.exe (PID: 7648)
      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 3656)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Drops script file

      • msedge.exe (PID: 2328)
      • powershell.exe (PID: 7660)
      • powershell.exe (PID: 8816)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 8960)

    • Reads Environment values

      • identity_helper.exe (PID: 8380)
      • ExLoader_Installer.exe (PID: 8180)
      • constantgeneral.exe (PID: 3656)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Create files in a temporary directory

      • ExLoader_Installer.exe (PID: 7648)
      • powershell.exe (PID: 8816)
      • constantgeneral.exe (PID: 476)
      • constantgeneral.exe (PID: 8120)

    • Reads security settings of Internet Explorer

      • ExLoader_Installer.exe (PID: 7648)
      • powershell.exe (PID: 8816)

    • Process checks computer location settings

      • ExLoader_Installer.exe (PID: 7648)
      • ExLoader_Installer.exe (PID: 8180)
      • constantgeneral.exe (PID: 3656)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Reads Windows Product ID

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 476)
      • constantgeneral.exe (PID: 3656)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Reads product name

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 3656)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 8120)

    • Creates files or folders in the user directory

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 3656)
      • ExLoader.exe (PID: 6336)
      • constantgeneral.exe (PID: 476)
      • constantgeneral.exe (PID: 8120)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7660)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7660)

    • Manual execution by a user

      • ExLoader.exe (PID: 3020)
      • ExLoader.exe (PID: 5504)
      • constantgeneral.exe (PID: 5628)
      • constantgeneral.exe (PID: 476)
      • ExLoader.exe (PID: 8936)
      • ExLoader.exe (PID: 6336)

    • Creates files in the program directory

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)

    • The sample compiled with english language support

      • ExLoader_Installer.exe (PID: 8180)
      • ExLoader.exe (PID: 5504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
188
Monitored processes
36
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
476"C:\Program Files\ExLoader\constantgeneral.exe" C:\Program Files\ExLoader\constantgeneral.exe
explorer.exe
User:
admin
Company:
com.swiftsoft
Integrity Level:
HIGH
Description:
Unified library of best and free in-game modifications.
Exit code:
4294967295
Version:
4.0.44+2640
Modules
Images
c:\program files\exloader\constantgeneral.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\gdi32full.dll
1212"C:\Users\admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe—ExLoader_Installer.exe
User:
admin
Company:
com.swiftsoft
Integrity Level:
MEDIUM
Description:
Installer for best and free unified library of in-game modifications.
Exit code:
3221226540
Version:
2.0.29+2233
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\exloader_installer.exe
c:\windows\system32\ntdll.dll
1932"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5892,i,2897689777572973485,5583342005992652765,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2244"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=3812,i,2897689777572973485,5583342005992652765,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2328"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=4764,i,2897689777572973485,5583342005992652765,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2376"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3600,i,2897689777572973485,5583342005992652765,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2392"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5156,i,2897689777572973485,5583342005992652765,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4240,i,2897689777572973485,5583342005992652765,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3020"C:\Program Files\ExLoader\ExLoader.exe" C:\Program Files\ExLoader\ExLoader.exe—explorer.exe
User:
admin
Company:
com.swiftsoft
Integrity Level:
MEDIUM
Description:
Unified library of best and free in-game modifications.
Exit code:
3221226540
Version:
4.0.44+2640
Modules
Images
c:\program files\exloader\exloader.exe
c:\windows\system32\ntdll.dll
Total events
267 319
Read events
267 318
Write events
1
Delete events
0

Modification events

(PID) Process:(7648) ExLoader_Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX
Operation:writeName:C%%Users%admin%AppData%Local%Temp
Value:
C:\Users\admin\AppData\Local\Temp\RarSFX0
Executable files
3
Suspicious files
0
Text files
3
Unknown types
714

Dropped files

PID
Process
Filename
Type
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1e53ac.TMP —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1e53bb.TMP —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1e53cb.TMP —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1e53cb.TMP —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1e53da.TMP —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1e53bb.TMP —
MD5:—
SHA256:—
8960msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
151
DNS requests
75
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8852
msedge.exe
GET
304
150.171.28.11:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
US
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
958 b
whitelisted
—
—
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
313 b
whitelisted
8852
msedge.exe
GET
301
172.66.152.149:80
http://data.exloader.net/ExLoader_Installer.exe
US
—
—
malicious
8852
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:UewTa65RhaE76fJIiJ8hr2aJd0Hxw71M3rzf8o84u0I&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
binary
98 b
whitelisted
8852
msedge.exe
GET
200
104.18.23.222:443
https://copilot.microsoft.com/c/api/user/eligibility
US
binary
25 b
whitelisted
8852
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
US
binary
446 b
whitelisted
8852
msedge.exe
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=66&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0
US
binary
4.47 Kb
whitelisted
8852
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/extensionwebstorebase/v1/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=133.0.3065.92&lang=en-US&acceptformat=crx3,puff&x=id%3Djmjflgjpcpepeafmmgdpfkogkghcpiha%26v%3D1.2.1%26installedby%3Dother%26uc%26ping%3Dr%253D72%2526e%253D1
US
binary
413 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
3208
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5780
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
2.16.241.218:443
th.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
172.66.2.5:80
ocsp.digicert.com
CLOUDFLARENET
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8852
msedge.exe
150.171.22.17:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 52.182.143.208
whitelisted
th.bing.com
  • 2.16.241.218
  • 2.16.241.201
  • 2.16.241.205
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.205
  • 2.16.241.201
whitelisted
ocsp.digicert.com
  • 172.66.2.5
  • 162.159.142.9
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
google.com
  • 172.217.20.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted

Threats

PID
Process
Class
Message
8852
msedge.exe
Potentially Bad Traffic
ET INFO PE EXE or DLL Windows file download HTTP
2292
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2292
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (ipapi .co in DNS lookup)
2292
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (ipapi .co in DNS lookup)
2292
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
8180
ExLoader_Installer.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
5780
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
data.exloader.net/ExLoader_Installer.exe