File name:

quicksoftware-dl.exe

Full analysis: https://app.any.run/tasks/0b7b7430-45c8-4391-b42c-06546947da04
Verdict: Malicious activity
Analysis date: May 24, 2025, 13:26:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

ADD26F07028D142EDB4EC2B018C9D62A

SHA1:

76D903040626DB9DB94552A0FE880E3FA75E863E

SHA256:

B12DE74429CCE391832B921C1E60D797C9E629BE3949A7BF24DBF871AC60B1D7

SSDEEP:

3072:ylZMtTwu1DZN9VVF1VlVrabVFXzaVS4TgIz4O9m5DtXU:y/MtJN9VVF1VlVSTXzaVS4TgIz4iqDm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • quicksoftware-dl.exe (PID: 7268)
      • WinRAR.exe (PID: 7260)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • quicksoftware-dl.exe (PID: 7268)

    • Executable content was dropped or overwritten

      • quicksoftware-dl.exe (PID: 7268)
      • aria2c.exe (PID: 7604)
      • notmyfault64.exe (PID: 3868)
      • notmyfault64.exe (PID: 5828)

    • Reads security settings of Internet Explorer

      • quicksoftware-dl.exe (PID: 7268)
      • WinRAR.exe (PID: 7260)

    • Starts CMD.EXE for commands execution

      • quicksoftware-dl.exe (PID: 7268)

    • There is functionality for taking screenshot (YARA)

      • quicksoftware-dl.exe (PID: 7268)

    • Drops 7-zip archiver for unpacking

      • aria2c.exe (PID: 7604)

    • Creates files in the driver directory

      • notmyfault64.exe (PID: 3868)

    • Drops a system driver (possible attempt to evade defenses)

      • notmyfault64.exe (PID: 5828)
      • notmyfault64.exe (PID: 3868)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4176)
      • PLUGScheduler.exe (PID: 1184)

  • INFO

    • Checks supported languages

      • quicksoftware-dl.exe (PID: 7268)
      • aria2c.exe (PID: 7604)
      • notmyfault64.exe (PID: 3868)

    • Checks proxy server information

      • quicksoftware-dl.exe (PID: 7268)

    • Create files in a temporary directory

      • quicksoftware-dl.exe (PID: 7268)

    • Creates files or folders in the user directory

      • quicksoftware-dl.exe (PID: 7268)

    • Reads the machine GUID from the registry

      • quicksoftware-dl.exe (PID: 7268)
      • aria2c.exe (PID: 7604)

    • Reads the computer name

      • quicksoftware-dl.exe (PID: 7268)
      • aria2c.exe (PID: 7604)
      • notmyfault64.exe (PID: 3868)

    • Reads the software policy settings

      • quicksoftware-dl.exe (PID: 7268)
      • slui.exe (PID: 7384)

    • The sample compiled with english language support

      • quicksoftware-dl.exe (PID: 7268)
      • aria2c.exe (PID: 7604)
      • WinRAR.exe (PID: 7260)
      • notmyfault64.exe (PID: 3868)
      • WinRAR.exe (PID: 5672)
      • notmyfault64.exe (PID: 5828)

    • Creates a new folder

      • cmd.exe (PID: 7536)

    • Manual execution by a user

      • WinRAR.exe (PID: 7260)
      • WinRAR.exe (PID: 5672)

    • Reads product name

      • notmyfault64.exe (PID: 3868)

    • Reads Environment values

      • notmyfault64.exe (PID: 3868)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5672)
      • WinRAR.exe (PID: 7260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
378
Monitored processes
18
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start quicksoftware-dl.exe sppextcomobj.exe no specs slui.exe svchost.exe cmd.exe no specs conhost.exe no specs aria2c.exe conhost.exe no specs slui.exe no specs rundll32.exe no specs winrar.exe notmyfault64.exe no specs notmyfault64.exe plugscheduler.exe no specs winrar.exe notmyfault64.exe no specs notmyfault64.exe plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1184"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3868"C:\Users\admin\AppData\Local\Temp\Rar$EXa7260.11088\notmyfault64.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7260.11088\notmyfault64.exe
WinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
HIGH
Description:
Driver Bug Test Program
Exit code:
0
Version:
4.21
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7260.11088\notmyfault64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4176"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
5428C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5672"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\downloaded-files\SysinternalsSuite.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5828"C:\Users\admin\AppData\Local\Temp\Rar$EXa5672.19785\notmyfault64.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5672.19785\notmyfault64.exe
WinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
HIGH
Description:
Driver Bug Test Program
Exit code:
0
Version:
4.21
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5672.19785\notmyfault64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
6116"C:\Users\admin\AppData\Local\Temp\Rar$EXa5672.19785\notmyfault64.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5672.19785\notmyfault64.exe—WinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Driver Bug Test Program
Exit code:
3221226540
Version:
4.21
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5672.19785\notmyfault64.exe
c:\windows\system32\ntdll.dll
6944"C:\Users\admin\AppData\Local\Temp\Rar$EXa7260.11088\notmyfault64.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7260.11088\notmyfault64.exe—WinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Driver Bug Test Program
Exit code:
3221226540
Version:
4.21
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7260.11088\notmyfault64.exe
c:\windows\system32\ntdll.dll
Total events
6 122
Read events
6 101
Write events
21
Delete events
0

Modification events

(PID) Process:(7268) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7268) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7268) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\downloaded-files\SysinternalsSuite.zip
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
369
Suspicious files
142
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
7268quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nstA75E.tmp\INetC.dllexecutable
MD5:40D7ECA32B2F4D29DB98715DD45BFAC5
SHA256:85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
7268quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nstA75E.tmp\System.dllexecutable
MD5:9B38A1B07A0EBC5C7E59E63346ECC2DB
SHA256:C881253DAFCF1322A771139B1A429EC1E78C507CA81A218A20DC1A4B25ABBFE7
7268quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_786EA6C36BF7ABFF201B638497282D19binary
MD5:2B6122114ECCB1AF7C0A4A48CCC44E37
SHA256:CFB4968F6EBCB42E857ED9A2E8F29383DC06B176FE1082C71944D46A9847BE98
7268quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nstA75E.tmp\modern-header.bmpimage
MD5:583C38FB0F5AF5FE584D9A9B01D6A3E7
SHA256:4C9E804CE1A391F8E603B7B9C732A6529C1E81BE4D12F125C8562EA9D49095C2
7268quicksoftware-dl.exeC:\Users\admin\Desktop\aria2c.exeexecutable
MD5:6C5EA5A82D756BCA4A9610C8D2260D2F
SHA256:B9CD71B275AF11B63C33457B0F43F2F2675937070C563E195F223EFD7FA4C74B
7268quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CE7B026C819922EDB9B7ED78605E20A3_731147EC87359F0E7CBB8FC748CE2C9Abinary
MD5:483B01035FDEA64CF61C1CECF471210F
SHA256:122EDEDB1D2E0CA26D9C93FC8DB94D2F63090867F40D0901B4ECFC3D0E0F862E
7604aria2c.exeC:\Users\admin\Desktop\downloaded-files\vlc-3.0.21-win64.exe.aria2__tempbinary
MD5:F3D70F5D8BC08C783EFA80E54C10E4D3
SHA256:6F45DAD11CE1ED5079D36466BE0B2D374DB7826C1C22AF1FE78F542E63768E1D
7268quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CE7B026C819922EDB9B7ED78605E20A3_731147EC87359F0E7CBB8FC748CE2C9Abinary
MD5:8843F1AE49584247BE4128757E5E5500
SHA256:903F16DAFC8BCDA73B59E9328A3C2FFE4DD350543D847ED50E2EE4B8BF6526CE
7268quicksoftware-dl.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\urllist[1].txttext
MD5:F71E3833F698C3C62409469692A5446B
SHA256:CFC2233ED169E5BEA2B1D9F04538F24B602B8ECC9016896300A6D5D5C59C7627
7268quicksoftware-dl.exeC:\Users\admin\Desktop\aria2script.txttext
MD5:F71E3833F698C3C62409469692A5446B
SHA256:CFC2233ED169E5BEA2B1D9F04538F24B602B8ECC9016896300A6D5D5C59C7627
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
78
DNS requests
58
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7268
quicksoftware-dl.exe
GET
200
108.138.36.22:80
http://ocsps.ssl.com/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBQMDtATfnJO6JAXDQoHl8pAaJdhTQQU3QQJB6L1en1SUxKSle44gCUNplkCCAmX7RCdHwf8
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
7268
quicksoftware-dl.exe
GET
200
108.138.36.22:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTUkpS%2BK0oZhSMx%2FmmCZ76UqdjUxQQUJhR%2B4NzXpvfi1AQn32HxwuznMsoCEFv%2BMpErdkO9Fsl4vDuI1mA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
756
lsass.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
756
lsass.exe
GET
200
3.167.227.86:80
http://r11.c.lencr.org/87.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
18.66.147.114:80
http://e6.c.lencr.org/46.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5796
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5036
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7268
quicksoftware-dl.exe
139.84.173.225:443
files.webdevtest.ftp.sh
AS-CHOOPA
US
unknown
7268
quicksoftware-dl.exe
108.138.36.22:80
ocsps.ssl.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.23
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.142
whitelisted
files.webdevtest.ftp.sh
  • 139.84.173.225
unknown
ocsps.ssl.com
  • 108.138.36.22
  • 108.138.36.51
  • 108.138.36.12
  • 108.138.36.71
whitelisted
7-zip.org
  • 49.12.202.237
unknown
github.com
  • 140.82.121.4
whitelisted
netcologne.dl.sourceforge.net
  • 78.35.24.122
whitelisted
mirror.kumi.systems
  • 110.172.148.126
  • 110.172.148.100
  • 110.172.148.107
  • 83.138.55.214
  • 110.172.148.96
  • 86.106.182.45
  • 110.172.148.86
  • 83.138.55.253
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ftp .sh Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ftp .sh Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
quicksoftware-dl.exe