File name:

点击此处-安装简体中文包1.exe

Full analysis: https://app.any.run/tasks/3661fa04-68ab-4fda-964a-eb18618e5d98
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: March 15, 2025, 02:49:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
innosetup
delphi
inno
installer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

2C5E148EF2930BC2A650D4E02CF0AC7F

SHA1:

9A7B0866580F0ADE9A4D4816E6ACCA2ACD94696D

SHA256:

8E2520D24398E764E666144790CF91F5E76F73CB4C87BB759FEC86BC1787DE08

SSDEEP:

49152:ddixrq3Bdwx2Ci+eElYquGs6u4+ZekEIT1Kj/alG/2AFEUDctf93eYISsXVK0o/A:irq3BdwMREpBs6uhkTI5KDalU2AFEOcS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • INNOSETUP has been detected (SURICATA)

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 点击此处-安装简体中文包1.exe (PID: 5072)
      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Reads the Windows owner or organization settings

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Drops 7-zip archiver for unpacking

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Access to an unwanted program domain was detected

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Potential Corporate Privacy Violation

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Process requests binary or script from the Internet

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Connects to the server without a host name

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
  • INFO

    • Create files in a temporary directory

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
      • 点击此处-安装简体中文包1.exe (PID: 5072)
    • Checks supported languages

      • 点击此处-安装简体中文包1.exe (PID: 5072)
      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Reads the computer name

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
      • 点击此处-安装简体中文包1.exe (PID: 5072)
    • Checks proxy server information

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
      • BackgroundTransferHost.exe (PID: 2240)
    • The sample compiled with english language support

      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Compiled with Borland Delphi (YARA)

      • 点击此处-安装简体中文包1.exe (PID: 5072)
      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Detects InnoSetup installer (YARA)

      • 点击此处-安装简体中文包1.exe (PID: 5072)
      • 点击此处-安装简体中文包1.tmp (PID: 2136)
    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2240)
      • BackgroundTransferHost.exe (PID: 4000)
      • BackgroundTransferHost.exe (PID: 6872)
      • BackgroundTransferHost.exe (PID: 2516)
      • BackgroundTransferHost.exe (PID: 6768)
    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 2240)
    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 2240)
      • slui.exe (PID: 6244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 114176
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: 79fe1 Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: 79fe1
ProductVersion: 16.371.875.349
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 点击此处-安装简体中文包1.exe #INNOSETUP 点击此处-安装简体中文包1.tmp sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs 点击此处-安装简体中文包1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Users\admin\AppData\Local\Temp\点击此处-安装简体中文包1.exe" C:\Users\admin\AppData\Local\Temp\点击此处-安装简体中文包1.exeexplorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
79fe1 Setup
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\appdata\local\temp\点击此处-安装简体中文包1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2136"C:\Users\admin\AppData\Local\Temp\is-N8Q1V.tmp\点击此处-安装简体中文包1.tmp" /SL5="$602DA,800256,800256,C:\Users\admin\AppData\Local\Temp\点击此处-安装简体中文包1.exe" C:\Users\admin\AppData\Local\Temp\is-N8Q1V.tmp\点击此处-安装简体中文包1.tmp
点击此处-安装简体中文包1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-n8q1v.tmp\点击此处-安装简体中文包1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2240"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2516"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4000"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5072"C:\Users\admin\AppData\Local\Temp\点击此处-安装简体中文包1.exe" C:\Users\admin\AppData\Local\Temp\点击此处-安装简体中文包1.exe
explorer.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
79fe1 Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\点击此处-安装简体中文包1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
6244"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6768"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6872"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6988C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 375
Read events
2 360
Write events
15
Delete events
0

Modification events

(PID) Process:(6768) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6768) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6768) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6872) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6872) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6872) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2516) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
6
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2240BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\401d3660-6f22-4ece-b7fd-df2d0f3d64d4.down_data
MD5:
SHA256:
2136点击此处-安装简体中文包1.tmpC:\Users\admin\AppData\Local\Temp\is-LMN2L.tmp\7z.exeexecutable
MD5:B6D5860F368B28CAA9DD14A51666A5CD
SHA256:E2CA3EC168AE9C0B4115CD4FE220145EA9B2DC4B6FC79D765E91F415B34D00DE
2136点击此处-安装简体中文包1.tmpC:\Users\admin\AppData\Local\Temp\is-LMN2L.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2136点击此处-安装简体中文包1.tmpC:\Users\admin\AppData\Local\Temp\is-LMN2L.tmp\is-LD4UE.tmpexecutable
MD5:C4AABD70DC28C9516809B775A30FDD3F
SHA256:882063948D675EE41B5AE68DB3E84879350EC81CF88D15B9BABF2FA08E332863
2240BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\401d3660-6f22-4ece-b7fd-df2d0f3d64d4.c758be2f-d312-42dd-bd58-0cbf24bdeafd.down_metabinary
MD5:FACC3E8B1CACBAA54C2E0A13961267DA
SHA256:6AA7E0FFA8AD44985047EB229708F21BAB6C14F65B1D1901A12FE138CD26E1FA
2240BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\58ee0808-f575-42d6-b1fe-940e4c6c6478.c758be2f-d312-42dd-bd58-0cbf24bdeafd.down_metabinary
MD5:FACC3E8B1CACBAA54C2E0A13961267DA
SHA256:6AA7E0FFA8AD44985047EB229708F21BAB6C14F65B1D1901A12FE138CD26E1FA
2136点击此处-安装简体中文包1.tmpC:\Users\admin\AppData\Local\Temp\is-LMN2L.tmp\is-F4SMK.tmpexecutable
MD5:B6D5860F368B28CAA9DD14A51666A5CD
SHA256:E2CA3EC168AE9C0B4115CD4FE220145EA9B2DC4B6FC79D765E91F415B34D00DE
2136点击此处-安装简体中文包1.tmpC:\Users\admin\AppData\Local\Temp\is-LMN2L.tmp\7z.dllexecutable
MD5:C4AABD70DC28C9516809B775A30FDD3F
SHA256:882063948D675EE41B5AE68DB3E84879350EC81CF88D15B9BABF2FA08E332863
2240BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:31B6B0A0AB7826FAB6E179D01CA4EDC7
SHA256:FC3311F12DE01AB6E5074D70A8A20838971187819403982625A4FE89FF643223
5072点击此处-安装简体中文包1.exeC:\Users\admin\AppData\Local\Temp\is-N8Q1V.tmp\点击此处-安装简体中文包1.tmpexecutable
MD5:A5DFBCD0920CC49B36A374CECC09D6C8
SHA256:5D8536513ED3A91A9161EB220DB91F1EB17E6BE3A63C63B5BC304D0CDD14F1CE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
28
DNS requests
18
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2136
点击此处-安装简体中文包1.tmp
GET
200
27.50.63.72:80
http://27.50.63.72/7z.dll
unknown
unknown
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
4688
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
unknown
2240
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
unknown
2136
点击此处-安装简体中文包1.tmp
GET
200
27.50.63.72:80
http://27.50.63.72/7z.exe
unknown
unknown
2136
点击此处-安装简体中文包1.tmp
GET
27.50.63.72:80
http://27.50.63.72/jy2x.7z
unknown
unknown
1660
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
unknown
1660
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:138
unknown
2136
点击此处-安装简体中文包1.tmp
27.50.63.72:80
BGPNET Global ASN
HK
unknown
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
unknown
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
unknown
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
unknown
google.com
  • 142.250.185.238
unknown
client.wns.windows.com
  • 40.113.110.67
unknown
login.live.com
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.140
unknown
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
unknown
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
unknown
slscr.update.microsoft.com
  • 4.175.87.197
unknown
www.microsoft.com
  • 2.23.181.156
unknown

Threats

PID
Process
Class
Message
2136
点击此处-安装简体中文包1.tmp
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 1
2136
点击此处-安装简体中文包1.tmp
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2136
点击此处-安装简体中文包1.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
2136
点击此处-安装简体中文包1.tmp
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2136
点击此处-安装简体中文包1.tmp
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2136
点击此处-安装简体中文包1.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
2136
点击此处-安装简体中文包1.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
No debug info