File name:

DiscordImageLogger.exe

Full analysis: https://app.any.run/tasks/acc8bb22-28d6-4fcd-81db-164eca0d1b73
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 03, 2025, 15:48:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
arch-doc
nodejs
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

D72714251ABCA41437952FA1C69606E2

SHA1:

3E4F57BF2AFF18F572062049B8F0CC29B43398F2

SHA256:

92BF5C61BCEFA13A20A2A49C3D9ECC59451E665DF15446F55109E94440FD7CF7

SSDEEP:

786432:Ka7nzJd85u5D8wrcD7g2TNN/UHYsH5NZnROWhku:33XR8wrcfTZNMHYcrXhku

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Application.exe (PID: 4228)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DiscordImageLogger.exe (PID: 5972)
      • Application.exe (PID: 4228)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • DiscordImageLogger.exe (PID: 5972)

    • Get information on the list of running processes

      • DiscordImageLogger.exe (PID: 5972)
      • cmd.exe (PID: 7720)

    • Drops 7-zip archiver for unpacking

      • DiscordImageLogger.exe (PID: 5972)

    • The process creates files with name similar to system file names

      • DiscordImageLogger.exe (PID: 5972)

    • Reads security settings of Internet Explorer

      • DiscordImageLogger.exe (PID: 5972)

    • Process drops legitimate windows executable

      • DiscordImageLogger.exe (PID: 5972)

    • There is functionality for taking screenshot (YARA)

      • DiscordImageLogger.exe (PID: 5972)

    • Starts CMD.EXE for commands execution

      • DiscordImageLogger.exe (PID: 5972)
      • Application.exe (PID: 4228)

    • Starts application with an unusual extension

      • cmd.exe (PID: 644)

    • Application launched itself

      • Application.exe (PID: 4228)

    • Creates a software uninstall entry

      • DiscordImageLogger.exe (PID: 5972)

  • INFO

    • The sample compiled with english language support

      • DiscordImageLogger.exe (PID: 5972)

    • Reads the computer name

      • DiscordImageLogger.exe (PID: 5972)
      • Application.exe (PID: 4228)
      • Application.exe (PID: 7344)
      • Application.exe (PID: 7224)

    • Create files in a temporary directory

      • DiscordImageLogger.exe (PID: 5972)
      • Application.exe (PID: 4228)
      • inj.exe (PID: 7560)

    • Checks supported languages

      • DiscordImageLogger.exe (PID: 5972)
      • Application.exe (PID: 4228)
      • chcp.com (PID: 5048)
      • Application.exe (PID: 7224)
      • Application.exe (PID: 7344)
      • inj.exe (PID: 7560)

    • Creates files or folders in the user directory

      • DiscordImageLogger.exe (PID: 5972)
      • Application.exe (PID: 4228)

    • Manual execution by a user

      • Application.exe (PID: 4228)
      • notepad.exe (PID: 4172)
      • OpenWith.exe (PID: 8072)
      • OpenWith.exe (PID: 8160)
      • OpenWith.exe (PID: 4976)
      • mspaint.exe (PID: 7896)

    • Reads product name

      • Application.exe (PID: 4228)

    • Process checks computer location settings

      • Application.exe (PID: 4228)

    • Changes the display of characters in the console

      • cmd.exe (PID: 644)

    • Checks proxy server information

      • Application.exe (PID: 4228)

    • Node.js compiler has been detected

      • Application.exe (PID: 7224)

    • Application launched itself

      • chrome.exe (PID: 8112)
      • msedge.exe (PID: 1244)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4172)

    • Reads Environment values

      • Application.exe (PID: 4228)

    • Reads the machine GUID from the registry

      • Application.exe (PID: 4228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Unreal Game Inc.
FileDescription: Best tools in 2025!
FileVersion: 1.0.0
LegalCopyright: Copyright © 2025 Unreal Game Inc.
ProductName: Application
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
63
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start discordimagelogger.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs application.exe cmd.exe no specs conhost.exe no specs chcp.com no specs application.exe no specs application.exe no specs inj.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe notepad.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs openwith.exe no specs inj.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
404C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
644C:\WINDOWS\system32\cmd.exe /d /s /c "chcp"C:\Windows\System32\cmd.exe—Application.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2148 --field-trial-handle=1940,i,5352891736258286100,14521987477799753805,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5124 --field-trial-handle=1940,i,5352891736258286100,14521987477799753805,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
900"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3532 --field-trial-handle=1940,i,5352891736258286100,14521987477799753805,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
960"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2676 --field-trial-handle=2360,i,5705120843206887702,3181370383208118760,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1244"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
inj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4836 --field-trial-handle=1940,i,5352891736258286100,14521987477799753805,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5220 --field-trial-handle=1940,i,5352891736258286100,14521987477799753805,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3704 --field-trial-handle=1940,i,5352891736258286100,14521987477799753805,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
18 416
Read events
18 380
Write events
35
Delete events
1

Modification events

(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\application
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:ShortcutName
Value:
Application
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:DisplayName
Value:
Application 1.0.0
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\application\Uninstall Application.exe" /currentuser
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\application\Uninstall Application.exe" /currentuser /S
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:DisplayVersion
Value:
1.0.0
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\application\Application.exe,0
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:Publisher
Value:
Unreal Game Inc.
(PID) Process:(5972) DiscordImageLogger.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\46d68d67-ad7d-52f1-8822-1f47ace9664b
Operation:writeName:NoModify
Value:
1
Executable files
27
Suspicious files
181
Text files
83
Unknown types
129

Dropped files

PID
Process
Filename
Type
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\app-64.7z —
MD5:—
SHA256:—
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\locales\de.pakpgc
MD5:2163820CD081FDD711B9230DC9284297
SHA256:6D787033C94755CC80C187ED8A9DE65808BB4D7968354BBB94B7868AC2E8D205
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\locales\cs.pakpgc
MD5:06E3FE72FDC73291E8CF6A44EB68B086
SHA256:397134D1834F395F1C467A75D84EF2E8545CB0F81E94DBE78B841FBBDAAD802D
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\locales\am.pakpgc
MD5:3CFD7C5BB92AB72C63E003208A9E4529
SHA256:12E9E1BEC1C46E5EA706157726E17A4429ACF288A5754FA183BD9B4CF7D3853B
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\locales\af.pakpgc
MD5:917A688D64ECCF67FEF5A5EB0908B6D4
SHA256:6981249837AD767FC030EDC8838878A5E493FB08CC49982CFFAED16CFBEB564D
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\StdUtils.dllexecutable
MD5:C6A6E03F77C313B267498515488C5740
SHA256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\7z-out\locales\el.pakpgc
MD5:A14D8A4499A8B2F2F5908D93E2065BF7
SHA256:EB46D9860835B69D33B2583D1E52B20238B666B967BF00906424E3C8A161ED64
5972DiscordImageLogger.exeC:\Users\admin\AppData\Local\Temp\nse17C7.tmp\SpiderBanner.dllexecutable
MD5:17309E33B596BA3A5693B4D3E85CF8D7
SHA256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
61
DNS requests
69
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2088
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7684
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
whitelisted
2088
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7684
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
whitelisted
7684
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
whitelisted
7684
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4608
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4164
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4228
Application.exe
104.21.48.1:443
beta.maveproj3ct.lol
CLOUDFLARENET
—
unknown
2088
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.68
  • 20.190.159.131
  • 20.190.159.64
  • 20.190.159.128
  • 40.126.31.131
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
beta.maveproj3ct.lol
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.16.1
  • 104.21.80.1
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
clientservices.googleapis.com
  • 142.250.185.195
whitelisted
accounts.google.com
  • 64.233.166.84
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DiscordImageLogger.exe