File name:

ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18

Full analysis: https://app.any.run/tasks/fe03454a-378b-4814-883a-b75d3371f75c
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 06:06:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ardamax
keylogger
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

E33AF9E602CBB7AC3634C2608150DD18

SHA1:

8F6EC9BC137822BC1DDF439C35FEDC3B847CE3FE

SHA256:

8C870EEC48BC4EA1ACA1F0C63C8A82AAADAF837F197708A7F0321238DA8B6B75

SSDEEP:

24576:iBdXdTAo/gy1SiK8rhLXp2kfBzKam5gsT2zrFpMc1fQIJBfCR/Uuxu/lvs9LTuDk:iBdXd8o/gy1SiK8rhL52kfBzZm5gsT2Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ARDAMAX has been detected

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • DPBJ.exe (PID: 6852)

    • Changes the autorun value in the registry

      • DPBJ.exe (PID: 6852)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)

    • Reads security settings of Internet Explorer

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)

    • Executes application which crashes

      • DPBJ.exe (PID: 6852)

  • INFO

    • Checks supported languages

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • DPBJ.exe (PID: 6852)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)
      • DPBJ.exe (PID: 896)

    • Creates files or folders in the user directory

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)
      • WerFault.exe (PID: 720)

    • Failed to create an executable file in Windows directory

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 6876)

    • Reads the software policy settings

      • slui.exe (PID: 900)
      • slui.exe (PID: 5972)

    • Manual execution by a user

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)
      • mspaint.exe (PID: 2288)
      • mspaint.exe (PID: 5600)
      • mspaint.exe (PID: 5512)

    • Reads the computer name

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • DPBJ.exe (PID: 6852)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)

    • Process checks computer location settings

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 3024)
      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 1812)

    • Checks proxy server information

      • slui.exe (PID: 5972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:03:04 14:29:05+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 9728
InitializedDataSize: 8704
UninitializedDataSize: -
EntryPoint: 0x32ee
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ARDAMAX ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe #ARDAMAX ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe #ARDAMAX dpbj.exe ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe dpbj.exe no specs werfault.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6852 -s 944C:\Windows\SysWOW64\WerFault.exe—DPBJ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
896"C:\WINDOWS\system32\28463\DPBJ.exe" C:\Windows\SysWOW64\28463\DPBJ.exe—ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\syswow64\28463\dpbj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
900"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1812"C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe" C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2288"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\onlyhorse.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3024"C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe" C:\Users\admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5428C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5512"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\periodtypes.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5600"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\externalcouncil.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5740C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
11 054
Read events
10 936
Write events
111
Delete events
7

Modification events

(PID) Process:(6852) DPBJ.exeKey:HKEY_CURRENT_USER\SOFTWARE\ASProtect\SpecData
Operation:writeName:F74DB923F74DB923
Value:
E6062F748F40D68809DC1C96D02C059285C573B7859DDCA3BCAD4908E9DE2A83043FC8B67D9FB54DDBFAA797E0F4A7677982D05B43970BAE1ED52F4E58706AADD7FBC38CA01E84E716093078982536F1DBD2015F0BD19865F909D9157328CD2282654CA7F0321E46822A89E2E3BB791E3D793AF8158E811D84CBD899A096E35EB7353C7825D5E5FC020FAF560220B0FBBCB842C215F275CE34DB9998B465DF35997BFF1346DE248CD9D51B900CE47A09FCE49B71DC89D09243CE4C3265F448EFA7DC1AC3F765F942303CDF159C16B726B7E9D47F2824DBE69B91BAF27658AD8EC6C13060BC4EC3779F7358D9A0A8B625EB31374CBBDC46BC983EC439D4E4180C05EC7AFC19294D346A2000BD580522191F243E839FB10E9DC44E99C29CF12802A7265357DE83825F389EFBA8
(PID) Process:(6852) DPBJ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:DPBJ Agent
Value:
C:\WINDOWS\SysWOW64\28463\DPBJ.exe
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(6852) DPBJ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:DPBJ Agent
Value:
C:\WINDOWS\SysWOW64\28463\DPBJ.exe
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:ProgramId
Value:
000697aa573324e81c2af53375bf5acb18d10000ffff
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:FileId
Value:
00004bd106cd9aefdf2b51f91079760855e04f73f3b0
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:LowerCaseLongPath
Value:
c:\windows\syswow64\28463\dpbj.exe
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:LongPathHash
Value:
dpbj.exe|e6268cb00e75f521
(PID) Process:(720) WerFault.exeKey:\REGISTRY\A\{388a56d0-7434-bd6c-cff2-234c7ed5701a}\Root\InventoryApplicationFile\dpbj.exe|e6268cb00e75f521
Operation:writeName:Name
Value:
DPBJ.exe
Executable files
9
Suspicious files
11
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\SysWOW64\28463\DPBJ.001binary
MD5:7A0F1FA20FD40C047B07379DA5290F2B
SHA256:B0AD9E9D3D51E8434CC466BEC16E2B94FC2D03BAB03B48CCF57DB86AE8E2C9B6
720WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DPBJ.exe_94b7ccf6c59552519826a9613c0b7e46c7e36aa_370b63e3_5e386246-b767-42d6-84df-03c8e1ffee2f\Report.wer —
MD5:—
SHA256:—
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@B99D.tmpexecutable
MD5:D73D89B1EA433724795B3D2B524F596C
SHA256:8AEF975A94C800D0E3E4929999D05861868A7129B766315C02A48A122E3455D6
6876ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@B9AE.tmpbinary
MD5:B2707130CE8F32AE3DA605FF9B541989
SHA256:A67B19BADAD7B971CF7918716CCE81FA3B63C3E7B593C583C5F99F744937F136
3024ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Windows\SysWOW64\28463\AKV.exeexecutable
MD5:97EEE85D1AEBF93D5D9400CB4E9C771B
SHA256:30DF6C8CBD255011D80FA6E959179D47C458BC4C4D9E78C4CF571AA611CD7D24
1812ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@71CD.tmpexecutable
MD5:D73D89B1EA433724795B3D2B524F596C
SHA256:8AEF975A94C800D0E3E4929999D05861868A7129B766315C02A48A122E3455D6
3024ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Windows\SysWOW64\28463\DPBJ.exeexecutable
MD5:B863A9AC3BCDCDE2FD7408944D5BF976
SHA256:0FE8E3CD44A89C15DEC75FF2949BAC1A96E1EA7E0040F74DF3230569AC9E37B0
720WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER73F0.tmp.dmpbinary
MD5:E8475CECA348F2B61D4E1DCA9852F36A
SHA256:F4C20AE12F8FF87FC2D76D3A48B22B66411DF863C3E128D202A6547395B5336C
720WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER753A.tmp.xmlxml
MD5:835A484B08CF06879E0917C47D569368
SHA256:9CC7D4AB5D2E1475171DCD63C4992C67DFDFF34101423CE6F95237344DCD8B7F
1812ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@71CE.tmpbinary
MD5:B2707130CE8F32AE3DA605FF9B541989
SHA256:A67B19BADAD7B971CF7918716CCE81FA3B63C3E7B593C583C5F99F744937F136
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
56
DNS requests
19
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.76:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4120
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1512
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 20.198.162.76
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.3
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.160.128
  • 40.126.32.76
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:800:5::bfee:a08d
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18