File name:

ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18

Full analysis: https://app.any.run/tasks/fe03454a-378b-4814-883a-b75d3371f75c
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 06:06:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ardamax
keylogger
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

E33AF9E602CBB7AC3634C2608150DD18

SHA1:

8F6EC9BC137822BC1DDF439C35FEDC3B847CE3FE

SHA256:

8C870EEC48BC4EA1ACA1F0C63C8A82AAADAF837F197708A7F0321238DA8B6B75

SSDEEP:

24576:iBdXdTAo/gy1SiK8rhLXp2kfBzKam5gsT2zrFpMc1fQIJBfCR/Uuxu/lvs9LTuDk:iBdXd8o/gy1SiK8rhL52kfBzZm5gsT2Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ARDAMAX has been detected

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • DPBJ.exe (PID: 6852)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)

    • Changes the autorun value in the registry

      • DPBJ.exe (PID: 6852)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)

    • Reads security settings of Internet Explorer

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)

    • Executes application which crashes

      • DPBJ.exe (PID: 6852)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 900)
      • slui.exe (PID: 5972)

    • Reads the computer name

      • DPBJ.exe (PID: 6852)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)

    • Manual execution by a user

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • mspaint.exe (PID: 5600)
      • mspaint.exe (PID: 5512)
      • mspaint.exe (PID: 2288)

    • Creates files or folders in the user directory

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • WerFault.exe (PID: 720)

    • Failed to create an executable file in Windows directory

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)

    • Checks supported languages

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • DPBJ.exe (PID: 6852)
      • DPBJ.exe (PID: 896)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)

    • Process checks computer location settings

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)

    • Checks proxy server information

      • slui.exe (PID: 5972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:03:04 14:29:05+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 9728
InitializedDataSize: 8704
UninitializedDataSize: -
EntryPoint: 0x32ee
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ARDAMAX ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe #ARDAMAX ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe #ARDAMAX dpbj.exe ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe dpbj.exe no specs werfault.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6852 -s 944C:\Windows\SysWOW64\WerFault.exe—DPBJ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
896"C:\WINDOWS\system32\28463\DPBJ.exe" C:\Windows\SysWOW64\28463\DPBJ.exe—ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\syswow64\28463\dpbj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
900"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1812"C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe" C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2288"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\onlyhorse.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3024"C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe" C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5428C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5512"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\periodtypes.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5600"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\externalcouncil.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5740C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
11 054
Read events
10 936
Write events
111
Delete events
7

Modification events

(PID) Process:(6852) DPBJ.exeKey:HKEY_CURRENT_USER\SOFTWARE\ASProtect\SpecData
Operation:writeName:F74DB923F74DB923
Value:
E6062F748F40D68809DC1C96D02C059285C573B7859DDCA3BCAD4908E9DE2A83043FC8B67D9FB54DDBFAA797E0F4A7677982D05B43970BAE1ED52F4E58706AADD7FBC38CA01E84E716093078982536F1DBD2015F0BD19865F909D9157328CD2282654CA7F0321E46822A89E2E3BB791E3D793AF8158E811D84CBD899A096E35EB7353C7825D5E5FC020FAF560220B0FBBCB842C215F275CE34DB9998B465DF35997BFF1346DE248CD9D51B900CE47A09FCE49B71DC89D09243CE4C3265F448EFA7DC1AC3F765F942303CDF159C16B726B7E9D47F2824DBE69B91BAF27658AD8EC6C13060BC4EC3779F7358D9A0A8B625EB31374CBBDC46BC983EC439D4E4180C05EC7AFC19294D346A2000BD580522191F243E839FB10E9DC44E99C29CF12802A7265357DE83825F389EFBA8
(PID) Process:(6852) DPBJ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:DPBJ Agent
Value:
C:\WINDOWS\SysWOW64\28463\DPBJ.exe
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(6852) DPBJ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:DPBJ Agent
Value:
C:\WINDOWS\SysWOW64\28463\DPBJ.exe
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:ProgramId
Value:
000697aa573324e81c2af53375bf5acb18d10000ffff
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:FileId
Value:
00004bd106cd9aefdf2b51f91079760855e04f73f3b0
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:LowerCaseLongPath
Value:
c:\windows\syswow64\28463\dpbj.exe
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:LongPathHash
Value:
dpbj.exe|e6268cb00e75f521
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:Name
Value:
DPBJ.exe
Executable files
9
Suspicious files
11
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\SysWOW64\28463\DPBJ.001binary
MD5:7A0F1FA20FD40C047B07379DA5290F2B
SHA256:B0AD9E9D3D51E8434CC466BEC16E2B94FC2D03BAB03B48CCF57DB86AE8E2C9B6
720WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DPBJ.exe_94b7ccf6c59552519826a9613c0b7e46c7e36aa_370b63e3_5e386246-b767-42d6-84df-03c8e1ffee2f\Report.wer —
MD5:—
SHA256:—
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@B99D.tmpexecutable
MD5:D73D89B1EA433724795B3D2B524F596C
SHA256:8AEF975A94C800D0E3E4929999D05861868A7129B766315C02A48A122E3455D6
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@B9AE.tmpbinary
MD5:B2707130CE8F32AE3DA605FF9B541989
SHA256:A67B19BADAD7B971CF7918716CCE81FA3B63C3E7B593C583C5F99F744937F136
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\SysWOW64\28463\DPBJ.007executable
MD5:A8E19DE6669E831956049685225058A8
SHA256:34856528D8B7E31CAA83F350BC4DBC861120DC2DA822A9EB896B773BC7E1F564
3024ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Windows\SysWOW64\28463\DPBJ.exeexecutable
MD5:B863A9AC3BCDCDE2FD7408944D5BF976
SHA256:0FE8E3CD44A89C15DEC75FF2949BAC1A96E1EA7E0040F74DF3230569AC9E37B0
3024ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Windows\SysWOW64\28463\key.binbinary
MD5:639D75AB6799987DFF4F0CF79FA70C76
SHA256:FC42AB050FFDFED8C8C7AAC6D7E4A7CAD4696218433F7CA327BCFDF9F318AC98
3024ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Windows\SysWOW64\28463\AKV.exeexecutable
MD5:97EEE85D1AEBF93D5D9400CB4E9C771B
SHA256:30DF6C8CBD255011D80FA6E959179D47C458BC4C4D9E78C4CF571AA611CD7D24
3024ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Windows\SysWOW64\28463\DPBJ.006executable
MD5:35B24C473BDCDB4411E326C6C437E8ED
SHA256:4530FCC91E4D0697A64F5E24D70E2B327F0ACAB1A9013102FF04236841C5A617
1812ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@71CD.tmpexecutable
MD5:D73D89B1EA433724795B3D2B524F596C
SHA256:8AEF975A94C800D0E3E4929999D05861868A7129B766315C02A48A122E3455D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
56
DNS requests
19
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.76:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4120
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1512
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 20.198.162.76
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.3
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.160.128
  • 40.126.32.76
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:800:5::bfee:a08d
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18