File name:

6DE2D70635A6A0165AC11D17C38FF7C5.exe

Full analysis: https://app.any.run/tasks/2eae0471-8608-425c-8aff-e3ca9aaca9e4
Verdict: Malicious activity
Analysis date: June 27, 2025, 06:21:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

6DE2D70635A6A0165AC11D17C38FF7C5

SHA1:

1A09B0818E32171173EF38F9865B653305E7F53A

SHA256:

B4B4698DA73018683286F253B507AA0E21FFD822194A6FE93ED314BE48768B8C

SSDEEP:

393216:tXA+eIrM+wn2Q4zHKP6BOiL8rn22sRBDL19K:iIwP2Q4Wrc8rnG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Signed with known abused certificate

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Executing a file with an untrusted certificate

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • unzip.exe (PID: 3648)

    • Changes Windows Defender settings

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Adds path to the Windows Defender exclusion list

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)
      • setup.exe (PID: 1688)

    • Executable content was dropped or overwritten

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • unzip.exe (PID: 3648)
      • man.exe (PID: 5444)

    • Likely accesses (executes) a file from the Public directory

      • setup.exe (PID: 1688)
      • unzip.exe (PID: 3648)
      • powershell.exe (PID: 3952)
      • man.exe (PID: 5444)

    • Creates file in the systems drive root

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Process drops legitimate windows executable

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Reads the Windows owner or organization settings

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Drops 7-zip archiver for unpacking

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • man.exe (PID: 5444)

    • Starts POWERSHELL.EXE for commands execution

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Script adds exclusion path to Windows Defender

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)

    • Executes application which crashes

      • man.exe (PID: 5444)

  • INFO

    • Checks supported languages

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)
      • setup.exe (PID: 1688)
      • unzip.exe (PID: 3648)
      • man.exe (PID: 5444)

    • Create files in a temporary directory

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 2356)

    • Reads the computer name

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • setup.exe (PID: 1688)
      • unzip.exe (PID: 3648)
      • man.exe (PID: 5444)

    • The sample compiled with english language support

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 2696)
      • man.exe (PID: 5444)

    • Process checks computer location settings

      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)

    • Checks proxy server information

      • setup.exe (PID: 1688)
      • WerFault.exe (PID: 5780)
      • slui.exe (PID: 6764)

    • Detects InnoSetup installer (YARA)

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 1688)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3952)

    • Compiled with Borland Delphi (YARA)

      • 6DE2D70635A6A0165AC11D17C38FF7C5.exe (PID: 7032)
      • 6DE2D70635A6A0165AC11D17C38FF7C5.tmp (PID: 188)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3952)

    • Creates files or folders in the user directory

      • setup.exe (PID: 1688)
      • WerFault.exe (PID: 5780)

    • Reads the software policy settings

      • setup.exe (PID: 1688)
      • WerFault.exe (PID: 5780)
      • slui.exe (PID: 6764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (91.2)
.exe | Win32 Executable (generic) (3.7)
.exe | Win16/32 Executable Delphi generic (1.7)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:12:20 14:16:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 86016
InitializedDataSize: 135168
UninitializedDataSize: -
EntryPoint: 0x16478
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 138.0.7156.0
ProductVersionNumber: 138.0.7156.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: 雷电模拟器 Setup
FileVersion: 138.0.7156.0
LegalCopyright:
ProductName: 雷电模拟器
ProductVersion: 138.0.7156.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 6de2d70635a6a0165ac11d17c38ff7c5.exe 6de2d70635a6a0165ac11d17c38ff7c5.tmp no specs 6de2d70635a6a0165ac11d17c38ff7c5.exe 6de2d70635a6a0165ac11d17c38ff7c5.tmp setup.exe powershell.exe no specs conhost.exe no specs unzip.exe conhost.exe no specs man.exe werfault.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Users\admin\AppData\Local\Temp\is-CPNUF.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp" /SL5="$50302,47188850,222208,C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe" C:\Users\admin\AppData\Local\Temp\is-CPNUF.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp—6DE2D70635A6A0165AC11D17C38FF7C5.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cpnuf.tmp\6de2d70635a6a0165ac11d17c38ff7c5.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Users\Public\Documents\setup.exe"C:\Users\Public\Documents\setup.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\public\documents\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2356"C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe" /SPAWNWND=$180330 /NOTIFYWND=$50302 C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
雷电模拟器 Setup
Exit code:
0
Version:
138.0.7156.0
Modules
Images
c:\users\admin\appdata\local\temp\6de2d70635a6a0165ac11d17c38ff7c5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2696"C:\Users\admin\AppData\Local\Temp\is-JV1RV.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp" /SL5="$702BE,47188850,222208,C:\Users\admin\AppData\Local\Temp\6DE2D70635A6A0165AC11D17C38FF7C5.exe" /SPAWNWND=$180330 /NOTIFYWND=$50302 C:\Users\admin\AppData\Local\Temp\is-JV1RV.tmp\6DE2D70635A6A0165AC11D17C38FF7C5.tmp
6DE2D70635A6A0165AC11D17C38FF7C5.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jv1rv.tmp\6de2d70635a6a0165ac11d17c38ff7c5.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3648"C:\Users\Public\Documents\unzip.exe" x -y -phtLcENyRFYwXsHFnUnqK -oC:\Users\Public\Documents C:\Users\Public\Documents\main.xmlC:\Users\Public\Documents\unzip.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
16.04
Modules
Images
c:\users\public\documents\unzip.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3952"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5444"C:\Users\Public\Documents\man.exe"C:\Users\Public\Documents\man.exe
6DE2D70635A6A0165AC11D17C38FF7C5.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
3221226356
Modules
Images
c:\users\public\documents\man.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5780C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5444 -s 716C:\Windows\SysWOW64\WerFault.exe
man.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6764C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
10 023
Read events
9 995
Write events
25
Delete events
3

Modification events

(PID) Process:(1688) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\ld\dnplayer
Operation:writeName:pcidex
Value:
V2jduo1ixJrmlcQ8K8H09ZiXn7aQaQEhoCgilbhtrTlHr586utTXUl6l/d77gm91
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:AppxPackageFullName
Value:
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:AppxPackageRelativeId
Value:
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:Size
Value:
0020150000000000
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:Language
Value:
0
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:Usn
Value:
B0B7A6B600000000
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:ProgramId
Value:
000672ec4edfbee669ac58f2dab40a8fba450000ffff
(PID) Process:(5780) WerFault.exeKey:\REGISTRY\A\{b7a65629-a0db-1c38-2a7e-13a6e62707ad}\Root\InventoryApplicationFile\man.exe|4920bd3e22959b55
Operation:writeName:FileId
Value:
0000a5e16ca4ae7f0b457adb2e6438963227924c8c5b
Executable files
12
Suspicious files
18
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-GA9MJ.tmp —
MD5:—
SHA256:—
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\QeiySBcapV.dat —
MD5:—
SHA256:—
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-FJ6J0.tmpbinary
MD5:F68BC422D7391034738E0F23CD97941D
SHA256:A77F26551640321751B8DAD3DCEABBCDEE8B7988C94C69F8285BBA601BFB7546
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-39TAV.tmpexecutable
MD5:AD9D7CBDB4B19FB65960D69126E3FF68
SHA256:A6C324F2925B3B3DBD2AD989E8D09C33ECC150496321AE5A1722AB097708F326
1688setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04Dbinary
MD5:2777B7C2CAE63D3606713EA1DD7851C4
SHA256:257756DFFC6AB16D9A49E2EE824CFFA9DDA86E76F37C9CCCC8AD5C696664F21D
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\main.xmlcompressed
MD5:3D9F03C646DE702AEDA1C20F54CEB282
SHA256:7F49AD89ECA6E12663E117AED605C37FF69F710B9E25E53D281A723DC8AF52C9
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\unzip.exeexecutable
MD5:AD9D7CBDB4B19FB65960D69126E3FF68
SHA256:A6C324F2925B3B3DBD2AD989E8D09C33ECC150496321AE5A1722AB097708F326
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\is-9FL08.tmpexecutable
MD5:23337E89A48AD4A6BEC0802A91791E07
SHA256:629C9947FDD42E16BE5786F89693C5EAC466B983C3F24AE5055ACD502C787DC7
3952powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_iyvmi3oj.5o3.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
26966DE2D70635A6A0165AC11D17C38FF7C5.tmpC:\Users\Public\Documents\setup.exeexecutable
MD5:23337E89A48AD4A6BEC0802A91791E07
SHA256:629C9947FDD42E16BE5786F89693C5EAC466B983C3F24AE5055ACD502C787DC7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
31
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
864
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1688
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ5rEWLwbJFq%2FmAU80sm7E%3D
unknown
—
—
whitelisted
1688
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSXi0cW5bD2WLrmnasWibg2OuPDpgQUVXRPsnJP9WC6UNHX5lFcmgGHGtcCEAaLh8TalJ4a1%2BN4jLQPsGY%3D
unknown
—
—
whitelisted
6260
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6260
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5780
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5780
WerFault.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2876
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
864
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
864
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.75
  • 20.190.159.131
  • 40.126.31.129
  • 40.126.31.130
  • 20.190.159.71
  • 20.190.159.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
res.ldmnq.com
  • 120.52.95.245
  • 218.12.76.152
  • 120.52.95.247
  • 218.12.76.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
Process
Message
man.exe
end
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6DE2D70635A6A0165AC11D17C38FF7C5.exe