File name:

PortableApps.com_Platform_Setup_29.5.3.paf.exe

Full analysis: https://app.any.run/tasks/831af95b-cd7d-49be-9e0a-7fb4cdb0d939
Verdict: Malicious activity
Analysis date: July 23, 2024, 01:04:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

FA3CFE5874612ACE62AC41853200EFA6

SHA1:

D7C6263C99DBC271AC54260BB44C3336AC857AD6

SHA256:

B6FB17E3B8DAE7036AD95FE90608CF3A673973D3342F42311586672790328A27

SSDEEP:

98304:NaX6stlTIixW7qizkvNsMR3vXnHO+0BFe2OoiphqepmEe7MqsUr6S5cydlg8DPOL:wpoFD5wX26GqxhVm+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • PortableAppsUpdater.exe (PID: 6812)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • PortableAppsUpdater.exe (PID: 6812)

    • Reads security settings of Internet Explorer

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • Start.exe (PID: 4404)
      • PortableAppsPlatform.exe (PID: 4212)
      • PortableAppsUpdater.exe (PID: 6812)

    • Write to the desktop.ini file (may be used to cloak folders)

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)

    • The process creates files with name similar to system file names

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • PortableAppsUpdater.exe (PID: 6812)

    • Drops 7-zip archiver for unpacking

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)

    • Executable content was dropped or overwritten

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • PortableAppsUpdater.exe (PID: 6812)

    • Reads the date of Windows installation

      • Start.exe (PID: 4404)
      • PortableAppsPlatform.exe (PID: 4212)

    • Creates file in the systems drive root

      • PortableAppsPlatform.exe (PID: 4212)

    • Checks for Java to be installed

      • PortableAppsPlatform.exe (PID: 4212)

    • Checks Windows Trust Settings

      • PortableAppsUpdater.exe (PID: 6812)

  • INFO

    • Checks supported languages

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • Start.exe (PID: 4404)
      • PortableAppsPlatform.exe (PID: 4212)
      • PortableAppsUpdater.exe (PID: 6812)
      • 7za.exe (PID: 4648)
      • TextInputHost.exe (PID: 364)

    • Reads the computer name

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • Start.exe (PID: 4404)
      • PortableAppsUpdater.exe (PID: 6812)
      • PortableAppsPlatform.exe (PID: 4212)
      • TextInputHost.exe (PID: 364)
      • 7za.exe (PID: 4648)

    • Create files in a temporary directory

      • PortableApps.com_Platform_Setup_29.5.3.paf.exe (PID: 2152)
      • PortableAppsUpdater.exe (PID: 6812)
      • 7za.exe (PID: 4648)

    • Reads the software policy settings

      • slui.exe (PID: 5576)
      • PortableAppsUpdater.exe (PID: 6812)

    • Checks proxy server information

      • slui.exe (PID: 5576)
      • PortableAppsUpdater.exe (PID: 6812)

    • Reads Environment values

      • Start.exe (PID: 4404)
      • PortableAppsPlatform.exe (PID: 4212)
      • PortableAppsUpdater.exe (PID: 6812)

    • Process checks computer location settings

      • Start.exe (PID: 4404)
      • PortableAppsPlatform.exe (PID: 4212)

    • Reads the machine GUID from the registry

      • PortableAppsUpdater.exe (PID: 6812)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 4636)

    • Creates files or folders in the user directory

      • PortableAppsUpdater.exe (PID: 6812)

    • Manual execution by a user

      • Taskmgr.exe (PID: 4636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:30 16:56:02+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 412160
UninitializedDataSize: 16384
EntryPoint: 0x3665
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 29.5.3.0
ProductVersionNumber: 29.5.3.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: For additional details, visit PortableApps.com
CompanyName: PortableApps.com
FileDescription: PortableApps.com Platform
FileVersion: 29.5.3.0
InternalName: PortableApps.com Platform
LegalCopyright: PortableApps.com
LegalTrademarks: PortableApps.com is a registered trademark of Rare Ideas, LLC.
OriginalFileName: PortableApps.com_Platform_Setup_29.5.3.paf.exe
PortableAppscomAppID: PortableApps.com
PortableAppscomFormatVersion: 3.8.0.0
PortableAppscomInstallerVersion: 3.8.3.0
ProductName: PortableApps.com Platform
ProductVersion: 29.5.3.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start portableapps.com_platform_setup_29.5.3.paf.exe slui.exe start.exe no specs portableappsplatform.exe no specs portableappsupdater.exe textinputhost.exe no specs 7za.exe no specs conhost.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
364"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
2152"C:\Users\admin\Desktop\PortableApps.com_Platform_Setup_29.5.3.paf.exe" C:\Users\admin\Desktop\PortableApps.com_Platform_Setup_29.5.3.paf.exe
explorer.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
PortableApps.com Platform
Exit code:
0
Version:
29.5.3.0
Modules
Images
c:\users\admin\desktop\portableapps.com_platform_setup_29.5.3.paf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4212"C:\Users\admin\Desktop\PortableApps\PortableApps.com\PortableAppsPlatform.exe" C:\Users\admin\Desktop\PortableApps\PortableApps.com\PortableAppsPlatform.exe—Start.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
PortableApps.com Platform
Version:
29.5.3.0
Modules
Images
c:\users\admin\desktop\portableapps\portableapps.com\portableappsplatform.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
4404C:\Users\admin\Desktop\Start.exeC:\Users\admin\Desktop\Start.exe—PortableApps.com_Platform_Setup_29.5.3.paf.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
Start PortableApps.com
Exit code:
0
Version:
29.5.3.0
Modules
Images
c:\users\admin\desktop\start.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
4636"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
4648"C:\Users\admin\Desktop\PortableApps\PortableApps.com\App\7-Zip\7za.exe" x "C:\Users\admin\AppData\Local\Temp\nsk9C44.tmp\update.7z" -o"C:\Users\admin\AppData\Local\Temp\nsk9C44.tmp" -aoaC:\Users\admin\Desktop\PortableApps\PortableApps.com\App\7-Zip\7za.exe—PortableAppsUpdater.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
24.07
Modules
Images
c:\users\admin\desktop\portableapps\portableapps.com\app\7-zip\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5576C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6812"C:\Users\admin\Desktop\PortableApps\PortableApps.com\PortableAppsUpdater.exe" /MODE=ADD /SHOWFREEWARE=all /KEYBOARDFRIENDLY=false /ADVANCED=false /SHOWINSTALLEDAPPS=false /HIDEPORTABLE=true /BETA=false /HIDE64BIT=false /INSTALL32BITDUALMODE=always /CONNECTION=AutomaticC:\Users\admin\Desktop\PortableApps\PortableApps.com\PortableAppsUpdater.exe
PortableAppsPlatform.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
PortableApps.com Updater
Version:
29.5.3.0
Modules
Images
c:\users\admin\desktop\portableapps\portableapps.com\portableappsupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
11 465
Read events
11 435
Write events
29
Delete events
1

Modification events

(PID) Process:(4404) Start.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4404) Start.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4404) Start.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4404) Start.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4212) PortableAppsPlatform.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\TPG\Recognizers
Operation:writeName:GestureTimeout
Value:
1500
(PID) Process:(4212) PortableAppsPlatform.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4212) PortableAppsPlatform.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4212) PortableAppsPlatform.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4212) PortableAppsPlatform.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6812) PortableAppsUpdater.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
34
Suspicious files
4
Text files
1 028
Unknown types
0

Dropped files

PID
Process
Filename
Type
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\LangDLL.dllexecutable
MD5:549EE11198143574F4D9953198A09FE8
SHA256:131AA0DF90C08DCE2EECEE46CCE8759E9AFFF04BF15B7B0002C2A53AE5E92C36
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\InstallCloudBox.icoimage
MD5:8230E343310B8AD58A3642466FFC0CA0
SHA256:4FE8A7B7618E0DDE72117437A6583BB14B5A0E0B9215DBEEABDE6CC404977821
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\InstallTypeLocal.icoimage
MD5:A8676F0BDFE1EE2547B87CFC6CED01DB
SHA256:1011AA4843604F7B5D6EB59A8E41B27F83007DFEC67AEF6F63FA6DFD54399E74
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\InstallCloudOneDrive.icoimage
MD5:314ED4E313894FAD9EF7AF45D71F2D11
SHA256:1FEE7F9360E24F5C3DDD4E05AAF5368749FC60B3AB24E1AF5B86B2A8FB170612
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\InstallCloudGoogleDrive.icoimage
MD5:8F8E5010A8B7DB88F0DDF093B726053F
SHA256:43CCCB5BF1E5BAF646B419F33E461D2DC265EA758C4C8FF70F1AC5AA17B0DDD4
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\modern-header.bmpimage
MD5:6288906FDF69A77C845B08BBEAF7A33B
SHA256:25C38D47D32816905CEEE5D7F1BE1FC400B080450D0D7EA68E3225CFF249373F
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\InstallTypeCloud.icoimage
MD5:FD20C8F4A900EF2763FD620B4EF7F3DA
SHA256:09DA891CC747228824450065D905D8DAA59AE51AA9370FDB068A83E25FEC2CD9
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\Desktop\Documents\Desktop.iniini
MD5:D587E3AD01C34A686DDA51EBDAC02A15
SHA256:0EE7ECEFB5E14F073721E20377D2CBCE0CFA25D44CB05E8E9994492086BA8D04
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\Desktop\Documents\Pictures\Desktop.iniini
MD5:B5252A47DD57F7349A9D464B5820295D
SHA256:416483A71A9763A1CF2D80BD803A305828494317DA667FE1470395400D95CB60
2152PortableApps.com_Platform_Setup_29.5.3.paf.exeC:\Users\admin\AppData\Local\Temp\nsd1EEF.tmp\InstallTypeUpgrade.icoimage
MD5:36348EA4D162CB644A091DA23028CEFE
SHA256:73EC55F223634FD221CDB947646FF2A75041B8285C6B183EEFD671FD30F039E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
57
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6812
PortableAppsUpdater.exe
GET
200
95.101.54.131:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgR0ZiEOoTZWMH3%2B6eRfyY97xA%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3076
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3800
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3360
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
unknown
5272
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.182
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.76
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PortableApps.com_Platform_Setup_29.5.3.paf.exe