File name:

Windows Pro Taskbar.msi

Full analysis: https://app.any.run/tasks/bfcbceee-9ca7-47c7-b575-dd8204034332
Verdict: Malicious activity
Analysis date: December 02, 2023, 19:03:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {35D3D526-D502-41C7-A590-D09206D3C13B}, Title: Install, Author: Install, Comments: Bringing the benefits of AI to everyone, Number of Words: 2, Last Saved Time/Date: Sat Dec 2 14:40:38 2023, Last Printed: Sat Dec 2 14:40:38 2023
MD5:

33DAC47110C5AA9BADA262A801996B1C

SHA1:

75F86D2A240E66AC7740B06E8DD3DD3EE48E87D7

SHA256:

9A32A0335D8D7165BD043488A51BCAC1315DEB105841DD7588C32D19081F10BC

SSDEEP:

24576:4uipiRvE4wThBDmmHFomQH/TMquzAN9X1ABV:4uipiRM4wThBDmmHFomc/TMquzk9XWj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3980)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 3600)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3156)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 564)
      • chrome.exe (PID: 3972)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1560)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 3980)

    • Executing commands from ".cmd" file

      • msiexec.exe (PID: 3980)

    • The process executes Powershell scripts

      • cmd.exe (PID: 3600)

    • Powershell version downgrade attack

      • powershell.exe (PID: 3156)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3600)

    • Reads the Internet Settings

      • powershell.exe (PID: 3156)
      • taskmgr.exe (PID: 2648)
      • taskmgr.exe (PID: 3076)

    • Application launched itself

      • taskmgr.exe (PID: 2648)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 3588)
      • msiexec.exe (PID: 3796)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 3588)
      • msiexec.exe (PID: 3796)

    • Checks supported languages

      • msiexec.exe (PID: 3796)
      • msiexec.exe (PID: 3588)
      • msiexec.exe (PID: 3980)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 3588)
      • msiexec.exe (PID: 3796)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3980)

    • Application launched itself

      • chrome.exe (PID: 3972)
      • msedge.exe (PID: 4016)
      • msiexec.exe (PID: 3980)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 3972)
      • msiexec.exe (PID: 564)

    • Manual execution by a user

      • taskmgr.exe (PID: 2648)

    • Reads the time zone

      • perfmon.exe (PID: 1420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: Intel;1033
Pages: 200
RevisionNumber: {35D3D526-D502-41C7-A590-D09206D3C13B}
Title: Install
Subject: -
Author: Install
Keywords: -
Comments: Bringing the benefits of AI to everyone
Words: 2
ModifyDate: 2023:12:02 14:40:38
LastPrinted: 2023:12:02 14:40:38
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
37
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs cmd.exe no specs powershell.exe no specs chrome.exe chrome.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs taskmgr.exe no specs taskmgr.exe perfmon.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
564"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Windows Pro Taskbar.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1356"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4040 --field-trial-handle=1160,i,78801202888492886,10381149692045693018,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1420"C:\Windows\System32\perfmon.exe" /resC:\Windows\System32\perfmon.exe—taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Resource and Performance Monitor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\perfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1560C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1672"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4248 --field-trial-handle=1348,i,14034409154449124852,6828535207008809068,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1876"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 --field-trial-handle=1348,i,14034409154449124852,6828535207008809068,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2060"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3408 --field-trial-handle=1348,i,14034409154449124852,6828535207008809068,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2072"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4068 --field-trial-handle=1348,i,14034409154449124852,6828535207008809068,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2120"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3568 --field-trial-handle=1348,i,14034409154449124852,6828535207008809068,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2044 --field-trial-handle=1160,i,78801202888492886,10381149692045693018,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
11 273
Read events
11 124
Write events
137
Delete events
12

Modification events

(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008C62D6BA16B0D901C80700002C0A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
400000000000000034645DBC16B0D901C80700002C0A0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Leave)
Value:
4000000000000000781D5ABD16B0D901C80700002C0A0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Leave)
Value:
4000000000000000781D5ABD16B0D901C80700002C0A0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3980) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:writeName:FirstRun
Value:
0
Executable files
10
Suspicious files
92
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
3980msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
564msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6882.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
3980msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:4796766E8E103A271E55DC78B734499F
SHA256:52D03F34E8FB12A76D300E26CE43D382A2BCA2035C731FB87C1987E94BD1A11F
564msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI68D1.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
3980msiexec.exeC:\Windows\Installer\MSI871C.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
3980msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF609B60733362818D.TMPbinary
MD5:A19C4CA3618320A12CB3F8135ECFFB17
SHA256:FE3C8151CC3B5665C9F4C149797668BD463D7F4DBD24F8652E4B4E996F22EC44
3980msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{85193b8e-b84c-4ba4-ba55-03a53f6ef26c}_OnDiskSnapshotPropbinary
MD5:4796766E8E103A271E55DC78B734499F
SHA256:52D03F34E8FB12A76D300E26CE43D382A2BCA2035C731FB87C1987E94BD1A11F
3588msiexec.exeC:\Users\admin\AppData\Local\Temp\CFG87A9.tmpxml
MD5:68675E0D405C8C76102802FA624EB895
SHA256:B839CDD1C3F55651CD4D0E54A679BCE5AC60ED7618A7B74BFC8EF8CA311E53ED
3796msiexec.exeC:\Users\admin\AppData\Local\Temp\CFG68C0.tmpxml
MD5:68675E0D405C8C76102802FA624EB895
SHA256:B839CDD1C3F55651CD4D0E54A679BCE5AC60ED7618A7B74BFC8EF8CA311E53ED
3980msiexec.exeC:\Program Files\Google\Install\System.Deployment.dllexecutable
MD5:A3866C0523804E20005AB9CCDC1DC8B8
SHA256:D1F155CBC36C0032382A39DEDAAB9D3CEB681ECE6DCFA988E34A3116B7CC5549
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
107
DNS requests
42
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2900
chrome.exe
142.250.185.196:443
www.google.com
GOOGLE
US
whitelisted
3972
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
2900
chrome.exe
142.250.186.138:443
www.googleapis.com
GOOGLE
US
whitelisted
2900
chrome.exe
64.233.166.84:443
accounts.google.com
GOOGLE
US
unknown
1876
msedge.exe
142.250.185.196:443
www.google.com
GOOGLE
US
whitelisted
4016
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
www.google.com
  • 142.250.185.196
whitelisted
www.googleapis.com
  • 142.250.186.138
  • 172.217.16.138
  • 216.58.212.138
  • 142.250.185.170
  • 142.250.184.234
  • 142.250.181.234
  • 142.250.185.138
  • 142.250.185.234
  • 142.250.185.74
  • 142.250.186.106
  • 172.217.18.106
  • 142.250.184.202
  • 142.250.185.202
  • 142.250.186.74
  • 142.250.185.106
  • 172.217.23.106
whitelisted
accounts.google.com
  • 64.233.166.84
shared
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
www.bing.com
  • 104.126.37.177
  • 104.126.37.155
  • 104.126.37.179
  • 104.126.37.176
  • 104.126.37.154
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.160
  • 104.126.37.185
  • 23.38.98.161
  • 23.38.98.151
  • 23.38.98.166
  • 23.38.98.133
  • 23.38.98.148
  • 23.38.98.136
  • 23.38.98.132
  • 23.38.98.150
  • 23.38.98.164
whitelisted
self.events.data.microsoft.com
  • 52.182.141.63
  • 13.89.178.26
whitelisted
www.gstatic.com
  • 216.58.212.131
whitelisted
edge-http.microsoft.com
  • 13.107.6.158
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows Pro Taskbar.msi