File name:

WinMTR64.exe

Full analysis: https://app.any.run/tasks/70fc0023-bf70-4722-841d-b54a23a5a68c
Verdict: Malicious activity
Analysis date: June 20, 2025, 07:48:44
OS: Windows 10 Professional (build: 19044, 64 bit)
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

C2BBD2EA8C512920FFDDCB21243D4951

SHA1:

CA3A4A922920FAD9597379132D4C0E91BB7F5771

SHA256:

9A0FA182B1381C0BA3D641317B75ACA6B434D3B3794599C5DF3A598A7E89DB74

SSDEEP:

49152:VJ7zjnOaF3dKp7vC/P9fbYyB0zanHB55a9goEuXepdsHUEbms/zJB3Kf6WaWj:HzjFFNHlD0ib5/3Gzbms7vI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • WinMTR64.exe (PID: 1944)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • WinMTR64.exe (PID: 1944)

  • INFO

    • Checks supported languages

      • WinMTR64.exe (PID: 1944)

    • The sample compiled with english language support

      • WinMTR64.exe (PID: 1944)

    • Reads the computer name

      • WinMTR64.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2014:01:13 04:21:52+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 10
CodeSize: 1590272
InitializedDataSize: 830464
UninitializedDataSize: -
EntryPoint: 0x15eca4
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: WinMTR Redux (original by Appnor MSP - www.winmtr.net)
FileVersion: 1.0.0.0
InternalName: WinMTR
LegalCopyright: WinMTR 0.9 (c) 2010-2011 Appnor MSP - Fully Managed Hosting & Cloud Provider www.appnor.com
OriginalFileName: WinMTR.exe
ProductName: WinMTR Application
ProductVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winmtr64.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1944"C:\Users\admin\AppData\Local\Temp\WinMTR64.exe" C:\Users\admin\AppData\Local\Temp\WinMTR64.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WinMTR Redux (original by Appnor MSP - www.winmtr.net)
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\winmtr64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3836C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
407
Read events
398
Write events
9
Delete events
0

Modification events

(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR
Operation:writeName:Version
Value:
1.0
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR
Operation:writeName:License
Value:
GPLv2 - GNU General Public License, version 2
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR
Operation:writeName:HomePage
Value:
https://github.com/White-Tiger/WinMTR
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR\Config
Operation:writeName:PingSize
Value:
64
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR\Config
Operation:writeName:MaxLRU
Value:
128
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR\Config
Operation:writeName:UseDNS
Value:
1
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR\Config
Operation:writeName:UseIPv6
Value:
2
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR\Config
Operation:writeName:Interval
Value:
1000
(PID) Process:(1944) WinMTR64.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinMTR\LRU
Operation:writeName:NrLRU
Value:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1204
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1204
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2292
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6172
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2292
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2292
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.131
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinMTR64.exe