File name:

IP.exe

Full analysis: https://app.any.run/tasks/1aa162b2-11a2-412e-aebd-f4c47f39019e
Verdict: Malicious activity
Analysis date: April 13, 2025, 17:13:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

48D87A253517D7F5662A5A1B67611A68

SHA1:

9C26A289701D5549D79034854B46E8A8A88AEB62

SHA256:

9C5CA23DF27A35BD532FDD8D5DCF43457D8EA8BDC6EE6A4A5866DC8AE7E425B1

SSDEEP:

196608:BV0qehtCunUv8lF91TOYfbLy5nADDOAIPEnoYR:BVMhtdxFHTOYfbLy5nAXOARf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • IP.exe (PID: 7520)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • IP.exe (PID: 7376)
      • IP.exe (PID: 7520)

    • Reads the BIOS version

      • IP.exe (PID: 7520)

    • Process drops legitimate windows executable

      • IP.exe (PID: 7520)

    • Detected use of alternative data streams (AltDS)

      • IP.exe (PID: 7520)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Reads security settings of Internet Explorer

      • IP.exe (PID: 7520)

    • Executable content was dropped or overwritten

      • IP.exe (PID: 7520)

  • INFO

    • The sample compiled with english language support

      • IP.exe (PID: 7520)

    • Reads mouse settings

      • IP.exe (PID: 7520)
      • unsecapp.exe (PID: 7740)

    • Process checks whether UAC notifications are on

      • IP.exe (PID: 7520)

    • Checks supported languages

      • IP.exe (PID: 7520)

    • Reads the computer name

      • IP.exe (PID: 7520)

    • Reads the machine GUID from the registry

      • IP.exe (PID: 7520)

    • Reads Environment values

      • IP.exe (PID: 7520)

    • Reads product name

      • IP.exe (PID: 7520)

    • Reads the software policy settings

      • IP.exe (PID: 7520)

    • Checks proxy server information

      • IP.exe (PID: 7520)
      • slui.exe (PID: 4776)

    • Creates files or folders in the user directory

      • IP.exe (PID: 7520)

    • Create files in a temporary directory

      • IP.exe (PID: 7520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:08 18:51:39+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 734208
InitializedDataSize: 14552576
UninitializedDataSize: -
EntryPoint: 0x15c2730
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 10.0.17763.2989
ProductVersionNumber: 10.0.17763.2989
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Help and Support
FileVersion: 10.0.17763.2989 (WinBuild.160101.0800)
InternalName: HelpPane.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: HelpPane.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17763.2989
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ip.exe svchost.exe unsecapp.exe no specs slui.exe ip.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4776C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7376"C:\Users\admin\AppData\Local\Temp\IP.exe" C:\Users\admin\AppData\Local\Temp\IP.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Help and Support
Exit code:
3221226540
Version:
10.0.17763.2989 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ip.exe
c:\windows\system32\ntdll.dll
7520"C:\Users\admin\AppData\Local\Temp\IP.exe" C:\Users\admin\AppData\Local\Temp\IP.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Help and Support
Exit code:
0
Version:
10.0.17763.2989 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\msvcrt.dll
7740C:\Windows\SysWOW64\unsecapp.exeC:\Windows\SysWOW64\unsecapp.exe—IP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Sync
Version:
10.0.17763.1697 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\unsecapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
Total events
1 140
Read events
1 136
Write events
4
Delete events
0

Modification events

(PID) Process:(7520) IP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7520) IP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7520) IP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7520) IP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Realtek HD Audio
Value:
C:\ProgramData\RealtekHD\taskhostw.exe
Executable files
2
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7520IP.exeC:\Users\admin\AppData\Local\Temp\autCC5A.tmpexecutable
MD5:F41AC8C7F6F7871848DDB6FB718A15BB
SHA256:D30A26D6F6676D700F86DB8FF522CCCFEA285E1272F2DBA210CF99C3B676A773
7520IP.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
7520IP.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
7520IP.exeC:\Windows\SysWOW64\unsecapp.exeexecutable
MD5:F41AC8C7F6F7871848DDB6FB718A15BB
SHA256:D30A26D6F6676D700F86DB8FF522CCCFEA285E1272F2DBA210CF99C3B676A773
7520IP.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:8A92FBD8C723E3B16C3E56D1D9E77007
SHA256:E9450E2A58EC4B2DB884EF9172C81F678A04CEB4AA153E8B411060A28288C977
7520IP.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:63EB128E6F29402BB96BA9DA7D04038F
SHA256:178CA6FD1628154CE2914AC703BDA238656A0752135D3557140AD6FBE159EF75
7520IP.exeC:\Users\admin\AppData\Local\Temp\autD0C0.tmpbinary
MD5:8A68FFB80F29AB414081078D4ABE6E19
SHA256:68DE18AE85A1FDF151AC8707D13C7CE0B4B731ABB8745E4C84E8AA3851A04EE7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.198.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7520
IP.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7520
IP.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2564
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.198.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7520
IP.exe
104.21.82.93:443
iplogger.co
CLOUDFLARENET
—
shared
7520
IP.exe
142.250.186.131:80
c.pki.goog
GOOGLE
US
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.19.198.194
  • 23.32.238.34
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
iplogger.co
  • 104.21.82.93
  • 172.67.167.249
shared
c.pki.goog
  • 142.250.186.131
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.69
  • 20.190.159.23
  • 20.190.159.130
  • 20.190.159.131
  • 40.126.31.129
  • 20.190.159.2
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] IP Checker (iplogger .co)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
IP.exe