File name:

6DE2D70635A6A0165AC11D17C38FF7C5.exe

Full analysis: https://app.any.run/tasks/2eae0471-8608-425c-8aff-e3ca9aaca9e4
Verdict: Malicious activity
Analysis date: June 27, 2025, 06:21:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

6DE2D70635A6A0165AC11D17C38FF7C5

SHA1:

1A09B0818E32171173EF38F9865B653305E7F53A

SHA256:

B4B4698DA73018683286F253B507AA0E21FFD822194A6FE93ED314BE48768B8C

SSDEEP:

393216:tXA+eIrM+wn2Q4zHKP6BOiL8rn22sRBDL19K:iIwP2Q4Wrc8rnG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • unzip.exe (PID: 3648)

    • Signed with known abused certificate

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Changes Windows Defender settings

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Adds path to the Windows Defender exclusion list

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • unzip.exe (PID: 3648)
      • man.exe (PID: 5444)

    • Reads security settings of Internet Explorer

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)
      • setup.exe (PID: 1688)

    • Reads the Windows owner or organization settings

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Process drops legitimate windows executable

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Drops 7-zip archiver for unpacking

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • man.exe (PID: 5444)

    • Likely accesses (executes) a file from the Public directory

      • setup.exe (PID: 1688)
      • powershell.exe (PID: 3952)
      • unzip.exe (PID: 3648)
      • man.exe (PID: 5444)

    • Creates file in the systems drive root

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Starts POWERSHELL.EXE for commands execution

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Script adds exclusion path to Windows Defender

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Executes application which crashes

      • man.exe (PID: 5444)

  • INFO

    • Checks supported languages

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • setup.exe (PID: 1688)
      • man.exe (PID: 5444)
      • unzip.exe (PID: 3648)

    • Create files in a temporary directory

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Reads the computer name

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • setup.exe (PID: 1688)
      • unzip.exe (PID: 3648)
      • man.exe (PID: 5444)

    • Process checks computer location settings

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)

    • The sample compiled with english language support

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • man.exe (PID: 5444)

    • Reads the software policy settings

      • setup.exe (PID: 1688)
      • WerFault.exe (PID: 5780)
      • slui.exe (PID: 6764)

    • Detects InnoSetup installer (YARA)

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3952)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3952)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 1688)

    • Compiled with Borland Delphi (YARA)

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)

    • Checks proxy server information

      • WerFault.exe (PID: 5780)
      • slui.exe (PID: 6764)
      • setup.exe (PID: 1688)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5780)
      • setup.exe (PID: 1688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (91.2)
.exe | Win32 Executable (generic) (3.7)
.exe | Win16/32 Executable Delphi generic (1.7)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:12:20 14:16:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 86016
InitializedDataSize: 135168
UninitializedDataSize: -
EntryPoint: 0x16478
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 138.0.7156.0
ProductVersionNumber: 138.0.7156.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: 雷电模拟器 Setup
FileVersion: 138.0.7156.0
LegalCopyright:
ProductName: 雷电模拟器
ProductVersion: 138.0.7156.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 6de2d70635a6a0165ac11d17c38ff7c5.exe 6de2d70635a6a0165ac11d17c38ff7c5.tmp no specs 6de2d70635a6a0165ac11d17c38ff7c5.exe 6de2d70635a6a0165ac11d17c38ff7c5.tmp setup.exe powershell.exe no specs conhost.exe no specs unzip.exe conhost.exe no specs man.exe werfault.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Users\admin\AppData\Local\Temp\is-CPNUF.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp" /SL5="$50302,47188850,222208,C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe" C:\Users\admin\AppData\Local\Temp\is-CPNUF.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp—6DE2D70635A6A0165AC11D17C38FF7C5.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cpnuf.tmp\6de2d70635a6a0165ac11d17c38ff7c5.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Users\Public\Documents\setup.exe"C:\Users\Public\Documents\setup.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\public\documents\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2356"C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe" /SPAWNWND=$180330 /NOTIFYWND=$50302 C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
雷电模拟器 Setup
Exit code:
0
Version:
138.0.7156.0
Modules
Images
c:\users\admin\appdata\local\temp\6de2d70635a6a0165ac11d17c38ff7c5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2696"C:\Users\admin\AppData\Local\Temp\is-JV1RV.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp" /SL5="$702BE,47188850,222208,C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe" /SPAWNWND=$180330 /NOTIFYWND=$50302 C:\Users\admin\AppData\Local\Temp\is-JV1RV.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp
6DE2D70635A6A0165AC11D17C38FF7C5.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jv1rv.tmp\6de2d70635a6a0165ac11d17c38ff7c5.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3648"C:\Users\Public\Documents\unzip.exe" x -y -phtLcENyRFYwXsHFnUnqK -oC:\Users\Public\Documents C:\Users\Public\Documents\main.xmlC:\Users\Public\Documents\unzip.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
16.04
Modules
Images
c:\users\public\documents\unzip.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3952"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5444"C:\Users\Public\Documents\man.exe"C:\Users\Public\Documents\man.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
3221226356
Modules
Images
c:\users\public\documents\man.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5780C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5444 -s 716C:\Windows\SysWOW64\WerFault.exe
man.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6764C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
10 023
Read events
9 995
Write events
25
Delete events
3

Modification events

(PID) Process:(1688) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\ld\dnplayer
Operation:writeName:pcidex
Value:
V2jduo1ixJrmlcQ8K8H09ZiXn7aQaQEhoCgilbhtrTlHr586utTXUl6l/d77gm91
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:AppxPackageFullName
Value:
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:AppxPackageRelativeId
Value:
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:Size
Value:
0020150000000000
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:Language
Value:
0
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:Usn
Value:
B0B7A6B600000000
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:ProgramId
Value:
000672ec4edfbee669ac58f2dab40a8fba450000ffff
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:FileId
Value:
0000a5e16ca4ae7f0b457adb2e6438963227924c8c5b
Executable files
12
Suspicious files
18
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-GA9MJ.tmp —
MD5:—
SHA256:—
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\QeiySBcapV.dat —
MD5:—
SHA256:—
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\admin\AppData\Local\Temp\is-4BVVV.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-FJ6J0.tmpbinary
MD5:F68BC422D7391034738E0F23CD97941D
SHA256:A77F26551640321751B8DAD3DCEABBCDEE8B7988C94C69F8285BBA601BFB7546
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-39TAV.tmpexecutable
MD5:AD9D7CBDB4B19FB65960D69126E3FF68
SHA256:A6C324F2925B3B3DBD2AD989E8D09C33ECC150496321AE5A1722AB097708F326
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-9FL08.tmpexecutable
MD5:23337E89A48AD4A6BEC0802A91791E07
SHA256:629C9947FDD42E16BE5786F89693C5EAC466B983C3F24AE5055ACD502C787DC7
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\WindowsData\Server.logbinary
MD5:F68BC422D7391034738E0F23CD97941D
SHA256:A77F26551640321751B8DAD3DCEABBCDEE8B7988C94C69F8285BBA601BFB7546
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\unzip.exeexecutable
MD5:AD9D7CBDB4B19FB65960D69126E3FF68
SHA256:A6C324F2925B3B3DBD2AD989E8D09C33ECC150496321AE5A1722AB097708F326
3952powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qbuirmdz.312.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1688setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\772D055D5E4421B179898A4E6FBD9ACCbinary
MD5:50279DA18CB7C54D216D8D0D62B6216B
SHA256:BBD3AF9F7B5C346DBC1D7F3D85A216F740D789B98433578DEC17E6AFD4D543BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
31
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6260
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5780
WerFault.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6260
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1688
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSXi0cW5bD2WLrmnasWibg2OuPDpgQUVXRPsnJP9WC6UNHX5lFcmgGHGtcCEAaLh8TalJ4a1%2BN4jLQPsGY%3D
unknown
—
—
whitelisted
1688
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ5rEWLwbJFq%2FmAU80sm7E%3D
unknown
—
—
whitelisted
5780
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2876
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
864
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
864
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.75
  • 20.190.159.131
  • 40.126.31.129
  • 40.126.31.130
  • 20.190.159.71
  • 20.190.159.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
res.ldmnq.com
  • 120.52.95.245
  • 218.12.76.152
  • 120.52.95.247
  • 218.12.76.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
Process
Message
man.exe
end
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6DE2D70635A6A0165AC11D17C38FF7C5.exe