File name:

exness5setup.exe

Full analysis: https://app.any.run/tasks/bb1ae57a-96da-4c13-8276-8449b65c7b55
Verdict: Malicious activity
Analysis date: December 09, 2024, 00:19:25
OS: Windows 11 Professional (build: 22000, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 10 sections
MD5:

F8681F5F46F570C3CC43B159C9C7EB6B

SHA1:

412764EF78B41C48376EFA9A64B32750577EDC17

SHA256:

95F9085C1F45EADD7D36C97AF4973A9353FD1DADA5DA74AE799860F7A4FC054F

SSDEEP:

98304:MA9SFUNDQL6vGJ6YtglXdKkg0O/mOe52MwTe/C7zJ5xiK9fx9SinTtoDgHhDAio1:H5CHobwmGwHa2jyod

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the BIOS version

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Reads security settings of Internet Explorer

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Reads the date of Windows installation

      • exness5setup.exe (PID: 2848)

    • Reads the Internet Settings

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Application launched itself

      • exness5setup.exe (PID: 2848)

    • Checks Windows Trust Settings

      • exness5setup.exe (PID: 2240)

    • Adds/modifies Windows certificates

      • exness5setup.exe (PID: 2240)

    • Reads settings of System Certificates

      • exness5setup.exe (PID: 2240)

    • Reads Internet Explorer settings

      • exness5setup.exe (PID: 2240)

  • INFO

    • Process checks whether UAC notifications are on

      • exness5setup.exe (PID: 2848)

    • Checks proxy server information

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Reads Windows Product ID

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Reads the computer name

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • The process uses the downloaded file

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Checks supported languages

      • exness5setup.exe (PID: 2848)
      • exness5setup.exe (PID: 2240)

    • Creates files in the program directory

      • exness5setup.exe (PID: 2240)

    • Reads CPU info

      • exness5setup.exe (PID: 2240)

    • Reads the machine GUID from the registry

      • exness5setup.exe (PID: 2240)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • exness5setup.exe (PID: 2240)

    • Creates files or folders in the user directory

      • exness5setup.exe (PID: 2240)

    • Reads the software policy settings

      • exness5setup.exe (PID: 2240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 1970:02:25 19:26:56+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 1530880
InitializedDataSize: 2522112
UninitializedDataSize: -
EntryPoint: 0x43f297e
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.0.0.4658
ProductVersionNumber: 5.0.0.4658
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://www.metaquotes.net
CompanyName: MetaQuotes Ltd.
FileDescription: Setup
FileVersion: 5.0.0.4658
InternalName: Setup
LegalCopyright: © 2000-2024, MetaQuotes Ltd.
LegalTrademarks: MetaTrader
OriginalFileName: Setup
ProductName: Setup
ProductVersion: 5.0.0.4658
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start exness5setup.exe exness5setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
2240"C:\Users\admin\Desktop\exness5setup.exe" C:\Users\admin\Desktop\exness5setup.exe
exness5setup.exe
User:
admin
Company:
MetaQuotes Ltd.
Integrity Level:
HIGH
Description:
Setup
Version:
5.0.0.4658
Modules
Images
c:\users\admin\desktop\exness5setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2848"C:\Users\admin\Desktop\exness5setup.exe" C:\Users\admin\Desktop\exness5setup.exe
explorer.exe
User:
admin
Company:
MetaQuotes Ltd.
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
5.0.0.4658
Modules
Images
c:\users\admin\desktop\exness5setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
5 142
Read events
5 123
Write events
17
Delete events
2

Modification events

(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\MetaQuotes Software
Operation:writeName:VideoAdapters
Value:
(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\MetaQuotes Software
Operation:writeName:ID
Value:
5188740765021481268
(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\MetaQuotes Software
Operation:writeName:Install.Time
Value:
1733703603
(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2848) exness5setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2240) exness5setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
Operation:delete valueName:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
Value:
(PID) Process:(2240) exness5setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
Operation:writeName:Blob
Value:
04000000010000001000000078F2FCAA601F2FB4EBC937BA532E7549140000000100000014000000ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F0B00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006F006F0074002000470034000000530000000100000040000000303E301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C00F00000001000000300000004EA1B34B10B982A96A38915843507820AD632C6AAD8343E337B34D660CD8366FA154544AE80668AE1FDF3931D57E1996030000000100000014000000DDFB16CD4931C973A2037D3FC83A4D7D775D05E4190000000100000010000000FFAC207997BB2CFE865570179EE037B9090000000100000034000000303206082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030106082B06010505070308620000000100000020000000552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC899881D0000000100000010000000A86DC6A233EB339610F3ED414927C5592000000001000000940500003082059030820378A0030201020210059B1B579E8E2132E23907BDA777755C300D06092A864886F70D01010C05003062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F74204734301E170D3133303830313132303030305A170D3338303131353132303030305A3062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F7420473430820222300D06092A864886F70D01010105000382020F003082020A0282020100BFE6907368DEBBE45D4A3C3022306933ECC2A7252EC9213DF28AD859C2E129A73D58AB769ACDAE7B1B840DC4301FF31BA43816EB56C6976D1DABB279F2CA11D2E45FD6053C520F521FC69E15A57EBE9FA95716595572AF689370C2B2BA75996A733294D11044102EDF82F30784E6743B6D71E22D0C1BEE20D5C9201D63292DCEEC5E4EC893F821619B34EB05C65EEC5B1ABCEBC9CFCDAC34405FB17A66EE77C848A86657579F54588E0C2BB74FA730D956EECA7B5DE3ADC94F5EE535E731CBDA935EDC8E8F80DAB69198409079C378C7B6B1C4B56A183803108DD8D437A42E057D88F5823E109170AB55824132D7DB04732A6E91017C214CD4BCAE1B03755D7866D93A31449A3340BF08D75A49A4C2E6A9A067DDA427BCA14F39B5115817F7245C468F64F7C169887698763D595D4276878997697A48F0E0A2121B669A74CADE4B1EE70E63AEE6D4EF92923A9E3DDC00E4452589B69A44192B7EC094B4D2616DEB33D9C5DF4B0400CC7D1C95C38FF721B2B211B7BB7FF2D58C702C4160AAB1631844951A76627EF680B0FBE864A633D18907E1BDB7E643A418B8A67701E10F940C211DB2542925896CE50E52514774BE26ACB64175DE7AAC5F8D3FC9BCD34111125BE51050EB31C5CA72162209DF7C4C753F63EC215FC420516B6FB1AB868B4FC2D6455F9D20FCA11EC5C08FA2B17E0A2699F5E4692F981D2DF5D9A9B21DE51B0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186301D0603551D0E04160414ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F300D06092A864886F70D01010C05000382020100BB61D97DA96CBE17C4911BC3A1A2008DE364680F56CF77AE70F9FD9A4A99B9C9785C0C0C5FE4E61429560B36495D4463E0AD9C9618661B230D3D79E96D6BD654F8D23CC14340AE1D50F552FC903BBB9899696BC7C1A7A868A427DC9DF927AE3085B9F6674D3A3E8F5939225344EBC85D03CAED507A7D62210A80C87366D1A005605FE8A5B4A7AFA8F76D359C7C5A8AD6A23899F3788BF44DD2200BDE04EE8C9B4781720DC01432EF30592EAEE071F256E46A976F92506D968D687A9AB236147A06F224B9091150D708B1B8897A8423614229E5A3CDA22041D7D19C64D9EA26A18B14D74C19B25041713D3F4D7023860C4ADC81D2CC3294840D0809971C4FC0EE6B207430D2E03934108521150108E85532DE7149D92817504DE6BE4DD175ACD0CAFB41B843A5AAD3C305444F2C369BE2FAE245B823536C066F67557F46B54C3F6E285A7926D2A4A86297D21EE2ED4A8BBC1BFD474A0DDF67667EB25B41D03BE4F43BF40463E9EFC2540051A08A2AC9CE78CCD5EA870418B3CEAF4988AFF39299B6B3E6610FD28500E7501AE41B959D19A1B99CB19BB1001EEFD00F4F426CC90ABCEE43FA3A71A5C84D26A535FD895DBC85621D32D2A02B54ED9A57C1DBFA10CF19B78B4A1B8F01B6279553E8B6896D5BBC68D423E88B51A256F9F0A680A0D61EB3BC0F0F537529AAEA1377E4DE8C8121AD07104711AD873D07D175BCCFF3667E
(PID) Process:(2240) exness5setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
Operation:writeName:Blob
Value:
5C0000000100000004000000001000001D0000000100000010000000A86DC6A233EB339610F3ED414927C559620000000100000020000000552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988090000000100000034000000303206082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030106082B06010505070308190000000100000010000000FFAC207997BB2CFE865570179EE037B9030000000100000014000000DDFB16CD4931C973A2037D3FC83A4D7D775D05E40F00000001000000300000004EA1B34B10B982A96A38915843507820AD632C6AAD8343E337B34D660CD8366FA154544AE80668AE1FDF3931D57E1996530000000100000040000000303E301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C00B00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006F006F0074002000470034000000140000000100000014000000ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F04000000010000001000000078F2FCAA601F2FB4EBC937BA532E75492000000001000000940500003082059030820378A0030201020210059B1B579E8E2132E23907BDA777755C300D06092A864886F70D01010C05003062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F74204734301E170D3133303830313132303030305A170D3338303131353132303030305A3062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F7420473430820222300D06092A864886F70D01010105000382020F003082020A0282020100BFE6907368DEBBE45D4A3C3022306933ECC2A7252EC9213DF28AD859C2E129A73D58AB769ACDAE7B1B840DC4301FF31BA43816EB56C6976D1DABB279F2CA11D2E45FD6053C520F521FC69E15A57EBE9FA95716595572AF689370C2B2BA75996A733294D11044102EDF82F30784E6743B6D71E22D0C1BEE20D5C9201D63292DCEEC5E4EC893F821619B34EB05C65EEC5B1ABCEBC9CFCDAC34405FB17A66EE77C848A86657579F54588E0C2BB74FA730D956EECA7B5DE3ADC94F5EE535E731CBDA935EDC8E8F80DAB69198409079C378C7B6B1C4B56A183803108DD8D437A42E057D88F5823E109170AB55824132D7DB04732A6E91017C214CD4BCAE1B03755D7866D93A31449A3340BF08D75A49A4C2E6A9A067DDA427BCA14F39B5115817F7245C468F64F7C169887698763D595D4276878997697A48F0E0A2121B669A74CADE4B1EE70E63AEE6D4EF92923A9E3DDC00E4452589B69A44192B7EC094B4D2616DEB33D9C5DF4B0400CC7D1C95C38FF721B2B211B7BB7FF2D58C702C4160AAB1631844951A76627EF680B0FBE864A633D18907E1BDB7E643A418B8A67701E10F940C211DB2542925896CE50E52514774BE26ACB64175DE7AAC5F8D3FC9BCD34111125BE51050EB31C5CA72162209DF7C4C753F63EC215FC420516B6FB1AB868B4FC2D6455F9D20FCA11EC5C08FA2B17E0A2699F5E4692F981D2DF5D9A9B21DE51B0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186301D0603551D0E04160414ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F300D06092A864886F70D01010C05000382020100BB61D97DA96CBE17C4911BC3A1A2008DE364680F56CF77AE70F9FD9A4A99B9C9785C0C0C5FE4E61429560B36495D4463E0AD9C9618661B230D3D79E96D6BD654F8D23CC14340AE1D50F552FC903BBB9899696BC7C1A7A868A427DC9DF927AE3085B9F6674D3A3E8F5939225344EBC85D03CAED507A7D62210A80C87366D1A005605FE8A5B4A7AFA8F76D359C7C5A8AD6A23899F3788BF44DD2200BDE04EE8C9B4781720DC01432EF30592EAEE071F256E46A976F92506D968D687A9AB236147A06F224B9091150D708B1B8897A8423614229E5A3CDA22041D7D19C64D9EA26A18B14D74C19B25041713D3F4D7023860C4ADC81D2CC3294840D0809971C4FC0EE6B207430D2E03934108521150108E85532DE7149D92817504DE6BE4DD175ACD0CAFB41B843A5AAD3C305444F2C369BE2FAE245B823536C066F67557F46B54C3F6E285A7926D2A4A86297D21EE2ED4A8BBC1BFD474A0DDF67667EB25B41D03BE4F43BF40463E9EFC2540051A08A2AC9CE78CCD5EA870418B3CEAF4988AFF39299B6B3E6610FD28500E7501AE41B959D19A1B99CB19BB1001EEFD00F4F426CC90ABCEE43FA3A71A5C84D26A535FD895DBC85621D32D2A02B54ED9A57C1DBFA10CF19B78B4A1B8F01B6279553E8B6896D5BBC68D423E88B51A256F9F0A680A0D61EB3BC0F0F537529AAEA1377E4DE8C8121AD07104711AD873D07D175BCCFF3667E
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2240exness5setup.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\Community\dns.dat —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
88
DNS requests
22
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
78.140.180.43:443
https://download.mql5.com/cdn/dns/dns.dat
unknown
—
—
—
5816
MoUsoCoreWorker.exe
GET
200
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?14a624a27f9453c6
unknown
—
—
whitelisted
—
—
GET
200
2.18.64.212:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
2860
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fd5a1b7975a5d4dc
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?6a9a8dc8f99a4184
unknown
—
—
whitelisted
—
—
HEAD
200
184.30.17.174:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
—
—
—
GET
200
78.140.180.86:443
https://content.mql5.com/tr?event=MetaTrader%205%20Desktop+Install+Begin&id=acoaoprbuhxvkfywgweedlovptddahwozl&utm_website=install.metatrader5.com&model=desktop&scr_res=1280x720&cpu=4&memory=4096&l=en&model_vendor=DELL&model_device=DELL&fv_date=1733703603&utm_source=my.exness.com&signature=9ad460b8d71b0f076f5637e1f5670e21650571733703604
unknown
image
70 b
—
—
—
GET
200
78.140.180.86:443
https://content.mql5.com/tr?event=MetaTrader%205%20Desktop+Install+Begin&id=acoaoprbuhxvkfywgweedlovptddahwozl&utm_company=Exness%20Technologies%20Ltd&utm_website=www.exness.com&model=desktop&scr_res=1280x720&cpu=4&memory=4096&l=en&model_vendor=DELL&model_device=DELL&fv_date=1733703603&utm_source=my.exness.com&signature=55848b0632336465bb84c40af27d2661525711733703609
unknown
image
70 b
—
—
—
GET
200
78.140.180.86:443
https://content.mql5.com/tr?event=MetaTrader%205%20Desktop+Install+CPU&id=acoaoprbuhxvkfywgweedlovptddahwozl&utm_website=install.metatrader5.com&model=desktop&scr_res=1280x720&cpu=4&memory=4096&l=en&model_vendor=DELL&model_device=DELL&fv_date=1733703603&utm_source=my.exness.com&value=Intel+Core+i5-6400++@+2.70GHz&unit=cpu&signature=e21d8c270cea881cb0250f79f4417fa2155071733703609
unknown
image
70 b
—
—
—
GET
200
78.140.180.86:443
https://content.mql5.com/tr?event=MetaTrader%205%20Desktop+Install+CPU+Cores&id=acoaoprbuhxvkfywgweedlovptddahwozl&utm_website=install.metatrader5.com&model=desktop&scr_res=1280x720&cpu=4&memory=4096&l=en&model_vendor=DELL&model_device=DELL&fv_date=1733703603&utm_source=my.exness.com&value=4&unit=cores&signature=1c965e6dd65941dba8368cf9fe539186235531733703609
unknown
image
70 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
—
—
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
—
—
2.18.64.212:80
—
Administracion Nacional de Telecomunicaciones
UY
unknown
5552
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5816
MoUsoCoreWorker.exe
84.201.210.23:80
ctldl.windowsupdate.com
IP4NET Sp. z o.o.
PL
whitelisted
—
—
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted
prod.remote-settings.prod.webservices.mozgcp.net
  • 34.149.100.209
whitelisted
telemetry-incoming.r53-2.services.mozilla.com
  • 34.120.208.123
whitelisted
google.com
  • 142.250.185.142
whitelisted
ctldl.windowsupdate.com
  • 84.201.210.23
  • 217.20.57.34
  • 217.20.57.35
  • 217.20.57.20
  • 217.20.57.19
  • 84.201.210.39
  • 217.20.57.36
  • 217.20.57.18
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
mrodevicemgr.officeapps.live.com
  • 52.109.89.117
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Microsoft Connection Test
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
exness5setup.exe