File name:

MaxAVPlusDM.exe

Full analysis: https://app.any.run/tasks/acbc51ef-8ad9-483b-8f1e-869df16ff182
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 18:37:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
loader
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

912BC7876F0202411C022F350D909514

SHA1:

45E8A797913D62FDBF440278C95EBCF6A7B3459B

SHA256:

97FA0096D18E4DCF3CF9B98D4F8E77390F7BB59234EFBC5ED551D83ABB94D018

SSDEEP:

12288:Cmy3DMmJ8uGfuX0Hl51ugKswe2M8cYl8vJRReQMJMFCJTrpSyh:CmIJ8sX0Hl51ujsYIJRReQkuCJ3h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MaxAVPlusDM.exe (PID: 7144)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • MaxAVPlusDM.exe (PID: 7144)

    • There is functionality for taking screenshot (YARA)

      • MaxAVPlusDM.exe (PID: 7144)

    • Executable content was dropped or overwritten

      • MSPlusX64.exe (PID: 3956)
      • MSPlusX64.tmp (PID: 968)
      • MSPlusX64.exe (PID: 4920)
      • MaxAVPSMemScanner.exe (PID: 5548)
      • MaxAVPSMemScanner.tmp (PID: 5728)

    • Reads the Windows owner or organization settings

      • MSPlusX64.tmp (PID: 968)
      • MaxAVPSMemScanner.tmp (PID: 5728)

    • Reads security settings of Internet Explorer

      • MaxAVPlusDM.exe (PID: 7144)
      • MSPlusX64.tmp (PID: 5640)
      • MSPlusX64.tmp (PID: 968)
      • MaxAVPSMemScanner.tmp (PID: 5728)

    • Process requests binary or script from the Internet

      • MaxAVPlusDM.exe (PID: 7144)

    • Searches for installed software

      • MSPlusX64.tmp (PID: 968)

    • Drops a system driver (possible attempt to evade defenses)

      • MSPlusX64.tmp (PID: 968)

    • Creates files in the driver directory

      • MSPlusX64.tmp (PID: 968)

  • INFO

    • The sample compiled with english language support

      • MaxAVPlusDM.exe (PID: 7144)
      • MaxAVPSMemScanner.tmp (PID: 5728)
      • MSPlusX64.tmp (PID: 968)

    • Create files in a temporary directory

      • MaxAVPlusDM.exe (PID: 7144)
      • MSPlusX64.exe (PID: 3956)
      • MSPlusX64.tmp (PID: 968)
      • MSPlusX64.exe (PID: 4920)
      • MaxAVPSMemScanner.exe (PID: 5548)
      • MaxAVPSMemScanner.tmp (PID: 5728)
      • MaxProcScn.exe (PID: 4180)

    • Auto-launch of the file from Registry key

      • MaxAVPlusDM.exe (PID: 7144)

    • Checks proxy server information

      • MaxAVPlusDM.exe (PID: 7144)

    • Reads the computer name

      • MaxAVPlusDM.exe (PID: 7144)
      • MaxAVPlusDM.exe (PID: 2152)
      • MSPlusX64.tmp (PID: 5640)
      • MSPlusX64.tmp (PID: 968)
      • MaxAVPSMemScanner.tmp (PID: 5728)
      • MaxProcScn.exe (PID: 4180)

    • Creates files or folders in the user directory

      • MaxAVPlusDM.exe (PID: 7144)

    • Checks supported languages

      • MaxAVPlusDM.exe (PID: 7144)
      • MaxAVPlusDM.exe (PID: 2152)
      • MSPlusX64.exe (PID: 3956)
      • MSPlusX64.tmp (PID: 968)
      • MSPlusX64.exe (PID: 4920)
      • MSPlusX64.tmp (PID: 5640)
      • MaxAVPSMemScanner.tmp (PID: 5728)
      • MaxAVPSMemScanner.exe (PID: 5548)
      • MaxProcScn.exe (PID: 4180)

    • Manual execution by a user

      • MaxAVPlusDM.exe (PID: 2152)

    • Process checks computer location settings

      • MSPlusX64.tmp (PID: 5640)
      • MaxAVPlusDM.exe (PID: 7144)
      • MSPlusX64.tmp (PID: 968)
      • MaxAVPSMemScanner.tmp (PID: 5728)

    • Detects InnoSetup installer (YARA)

      • MSPlusX64.tmp (PID: 5640)
      • MSPlusX64.exe (PID: 3956)
      • MSPlusX64.tmp (PID: 968)
      • MSPlusX64.exe (PID: 4920)

    • Compiled with Borland Delphi (YARA)

      • MSPlusX64.tmp (PID: 5640)
      • MSPlusX64.tmp (PID: 968)

    • Reads the software policy settings

      • slui.exe (PID: 5408)

    • Creates files in the program directory

      • MaxProcScn.exe (PID: 4180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:13 06:52:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 309248
InitializedDataSize: 335872
UninitializedDataSize: -
EntryPoint: 0x32ffc
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.2
InternalName: MaxAVPlus.exe
LegalCopyright: -
LegalTrademarks:
OriginalFileName: MaxAVPlus.exe
ProductName: MaxAVPlus
ProductVersion: 1.0.0.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start maxavplusdm.exe maxavplusdm.exe no specs sppextcomobj.exe no specs slui.exe msplusx64.exe msplusx64.tmp no specs msplusx64.exe msplusx64.tmp slui.exe no specs maxavpsmemscanner.exe maxavpsmemscanner.tmp maxprocscn.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
968"C:\Users\admin\AppData\Local\Temp\is-J8JA1.tmp\MSPlusX64.tmp" /SL5="$60346,224093263,463872,C:\Users\admin\Desktop\MSPlusX64.exe" /SPAWNWND=$60292 /NOTIFYWND=$40264 C:\Users\admin\AppData\Local\Temp\is-J8JA1.tmp\MSPlusX64.tmp
MSPlusX64.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-j8ja1.tmp\msplusx64.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2140C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2152"C:\Users\admin\AppData\Local\Temp\MaxAVPlusDM.exe"C:\Users\admin\AppData\Local\Temp\MaxAVPlusDM.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\users\admin\appdata\local\temp\maxavplusdm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3956"C:\Users\admin\Desktop\MSPlusX64.exe" /SPAWNWND=$60292 /NOTIFYWND=$40264 C:\Users\admin\Desktop\MSPlusX64.exe
MSPlusX64.tmp
User:
admin
Company:
Max Secure Software
Integrity Level:
HIGH
Description:
Max Secure Anti Virus Plus
Version:
19.0.4.057
Modules
Images
c:\users\admin\desktop\msplusx64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4180"C:\Users\admin\AppData\Local\Temp\is-K1IUJ.tmp\MaxProcScn.exe" C:\Users\admin\AppData\Local\Temp\is-K1IUJ.tmp\MaxProcScn.exe—MaxAVPSMemScanner.tmp
User:
admin
Company:
Max Secure Software
Integrity Level:
HIGH
Description:
Max Secure Software Memory Scanner
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\is-k1iuj.tmp\maxprocscn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4920"C:\Users\admin\Desktop\MSPlusX64.exe" C:\Users\admin\Desktop\MSPlusX64.exe
MaxAVPlusDM.exe
User:
admin
Company:
Max Secure Software
Integrity Level:
MEDIUM
Description:
Max Secure Anti Virus Plus
Version:
19.0.4.057
Modules
Images
c:\users\admin\desktop\msplusx64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5408"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5548"C:\Users\admin\AppData\Local\Temp\is-B56O2.tmp\MaxAVPSMemScanner.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-B56O2.tmp\MaxAVPSMemScanner.exe
MSPlusX64.tmp
User:
admin
Company:
Max Secure Software
Integrity Level:
HIGH
Description:
Max Secure Anti Virus
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\is-b56o2.tmp\maxavpsmemscanner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5640"C:\Users\admin\AppData\Local\Temp\is-TQ7CD.tmp\MSPlusX64.tmp" /SL5="$40264,224093263,463872,C:\Users\admin\Desktop\MSPlusX64.exe" C:\Users\admin\AppData\Local\Temp\is-TQ7CD.tmp\MSPlusX64.tmp—MSPlusX64.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-tq7cd.tmp\msplusx64.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5728"C:\Users\admin\AppData\Local\Temp\is-6EQJ5.tmp\MaxAVPSMemScanner.tmp" /SL5="$B0200,22434025,463872,C:\Users\admin\AppData\Local\Temp\is-B56O2.tmp\MaxAVPSMemScanner.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-6EQJ5.tmp\MaxAVPSMemScanner.tmp
MaxAVPSMemScanner.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-6eqj5.tmp\maxavpsmemscanner.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 153
Read events
2 143
Write events
9
Delete events
1

Modification events

(PID) Process:(7144) MaxAVPlusDM.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MaxDownloadMgr
Value:
"C:\Users\admin\AppData\Local\Temp\MaxAVPlusDM.exe"
(PID) Process:(7144) MaxAVPlusDM.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:MaxDownloadMgr
Value:
"C:\Users\admin\AppData\Local\Temp\MaxAVPlusDM.exe"
(PID) Process:(968) MSPlusX64.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MaxCryptMon\Instances
Operation:writeName:DefaultInstance
Value:
MaxCryptMon Instance
(PID) Process:(968) MSPlusX64.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MaxCryptMon\Instances\MaxCryptMon Instance
Operation:writeName:Altitude
Value:
328601
(PID) Process:(968) MSPlusX64.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MaxCryptMon\Instances\MaxCryptMon Instance
Operation:writeName:Flags
Value:
0
(PID) Process:(5728) MaxAVPSMemScanner.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
60160000D35CEBD891C6DB01
(PID) Process:(5728) MaxAVPSMemScanner.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
5363133E806BDD423CB4981FA1D79C83DC45896571E08DAB7177FA8F9264405F
(PID) Process:(5728) MaxAVPSMemScanner.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(5728) MaxAVPSMemScanner.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Local\Temp\is-K1IUJ.tmp\MaxAVRepair.dll
(PID) Process:(5728) MaxAVPSMemScanner.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
FF207D48AEA257B0AD121ABE8F78E7FAD206D6F16D95C3861AE5B9F49980EDCF
Executable files
44
Suspicious files
913
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
7144MaxAVPlusDM.exeC:\Users\admin\AppData\Local\Max Secure Software\MaxDownloadTemp\MSPlusX64.exe_4_3.tmp —
MD5:—
SHA256:—
7144MaxAVPlusDM.exeC:\Users\admin\AppData\Local\Max Secure Software\MaxDownloadTemp\MSPlusX64.exe_4_2.tmp —
MD5:—
SHA256:—
7144MaxAVPlusDM.exeC:\Users\admin\AppData\Local\Max Secure Software\MaxDownloadTemp\MSPlusX64.exe_4_1.tmp —
MD5:—
SHA256:—
7144MaxAVPlusDM.exeC:\Users\admin\AppData\Local\Max Secure Software\MaxDownloadTemp\MSPlusX64.exe_4_0.tmp —
MD5:—
SHA256:—
3956MSPlusX64.exeC:\Users\admin\AppData\Local\Temp\is-J8JA1.tmp\MSPlusX64.tmpexecutable
MD5:9BEA8A7953E912DF89AC52C55B508A8B
SHA256:1779EEA75077AF6B9AC1936BD45A60BF33A27C4664CBD34ABC2FFB798F20C121
968MSPlusX64.tmpC:\Users\admin\AppData\Local\Temp\is-B56O2.tmp\CheckDll.dllexecutable
MD5:B063EDC45256320F1402D93190913349
SHA256:84502182582DA3CFB93A1BC63CFF418F12BC26B523BC6F4AFC0E620B908DC2E7
4920MSPlusX64.exeC:\Users\admin\AppData\Local\Temp\is-TQ7CD.tmp\MSPlusX64.tmpexecutable
MD5:9BEA8A7953E912DF89AC52C55B508A8B
SHA256:1779EEA75077AF6B9AC1936BD45A60BF33A27C4664CBD34ABC2FFB798F20C121
968MSPlusX64.tmpC:\Users\admin\AppData\Local\Temp\is-B56O2.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7144MaxAVPlusDM.exeC:\Users\admin\AppData\Local\Max Secure Software\MaxDownloadTemp\maxdownloader.logtext
MD5:C567D09A48C2A2302876ED4B464B0E1A
SHA256:5274DD41B6380872CBC342E993CA7B5CBECA89E12C1D1274B37AEFAAE73DA27F
7144MaxAVPlusDM.exeC:\Users\admin\AppData\Local\Temp\~DFB4BC290BBDB9595E.TMPbinary
MD5:468B9C791777B9B0E152616999373CBE
SHA256:522E1426A3BB271CC41F8DF3DDC58B9A0AA67C9537ADC4D5BD538C7E6A87C6DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
29
DNS requests
22
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7144
MaxAVPlusDM.exe
GET
—
89.187.169.47:80
http://maxsecure.b-cdn.net/MSPlusX64.exe
unknown
—
—
whitelisted
7144
MaxAVPlusDM.exe
GET
206
89.187.169.47:80
http://maxsecure.b-cdn.net/MSPlusX64.exe
unknown
—
—
whitelisted
7144
MaxAVPlusDM.exe
GET
206
89.187.169.47:80
http://maxsecure.b-cdn.net/MSPlusX64.exe
unknown
—
—
whitelisted
7144
MaxAVPlusDM.exe
GET
206
89.187.169.47:80
http://maxsecure.b-cdn.net/MSPlusX64.exe
unknown
—
—
whitelisted
7144
MaxAVPlusDM.exe
GET
206
89.187.169.47:80
http://maxsecure.b-cdn.net/MSPlusX64.exe
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6744
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6744
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
616
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7144
MaxAVPlusDM.exe
89.187.169.47:80
maxsecure.b-cdn.net
Datacamp Limited
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.179
  • 23.48.23.158
  • 23.48.23.163
  • 23.48.23.171
  • 23.48.23.161
  • 23.48.23.164
  • 23.48.23.157
  • 23.48.23.170
  • 23.48.23.177
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
maxsecure.b-cdn.net
  • 89.187.169.47
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.4
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.5
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted

Threats

PID
Process
Class
Message
7144
MaxAVPlusDM.exe
Potential Corporate Privacy Violation
ET HUNTING Suspicious Malformed Double Accept Header
7144
MaxAVPlusDM.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7144
MaxAVPlusDM.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MaxAVPlusDM.exe