File name:

MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zip

Full analysis: https://app.any.run/tasks/ef611bc3-08d0-4c6e-9e23-7cf1139eed4a
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 25, 2025, 17:28:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
bundleinstaller
adware
innosetup
loader
arch-exec
inno
installer
delphi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E678C0CA8B00D9EB966A8114445DD69D

SHA1:

730AC2764FF65578003CD30583086FEEC23C093C

SHA256:

C17B20AA4210CB437FDBBA9EE282A4B6E09A02EDCEFE9AB8DA577C88D6BCB10E

SSDEEP:

98304:8blFWZFD494CStK9vp0BhGO2Nc/hUNhd7LjajB6iQ5zfslxb/huho/I2G51J/i4x:2HqIrz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bundleinstaller mutex has been found

      • glogg_V-zjLO1.tmp (PID: 1228)

    • INNOSETUP has been detected (SURICATA)

      • glogg_V-zjLO1.tmp (PID: 1228)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • glogg.exe (PID: 6972)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)

    • Reads security settings of Internet Explorer

      • glogg_V-zjLO1.tmp (PID: 3140)
      • saBSI.exe (PID: 5360)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 1184)
      • uihost.exe (PID: 3304)

    • Reads the Windows owner or organization settings

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Process requests binary or script from the Internet

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Potential Corporate Privacy Violation

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Access to an unwanted program domain was detected

      • glogg_V-zjLO1.tmp (PID: 1228)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)

    • Executes application which crashes

      • glogg_V-zjLO1.tmp (PID: 1228)

    • The process creates files with name similar to system file names

      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • glogg.exe (PID: 6972)

    • Creates a software uninstall entry

      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 1184)

    • Working with threads in the GNU C Compiler (GCC) libraries related mutex has been found

      • glogg.exe (PID: 1452)

    • Executes as Windows Service

      • servicehost.exe (PID: 6816)

    • Process drops legitimate windows executable

      • installer.exe (PID: 1184)

    • Adds/modifies Windows certificates

      • servicehost.exe (PID: 6816)
      • saBSI.exe (PID: 5360)

    • Reads Mozilla Firefox installation path

      • servicehost.exe (PID: 6816)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4380)

    • Manual execution by a user

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg.exe (PID: 1452)

    • Checks supported languages

      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 3140)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)
      • glogg.exe (PID: 1452)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • Process checks computer location settings

      • glogg_V-zjLO1.tmp (PID: 3140)
      • glogg_V-zjLO1.tmp (PID: 1228)

    • Create files in a temporary directory

      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)

    • Reads the computer name

      • glogg_V-zjLO1.tmp (PID: 3140)
      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)
      • glogg.exe (PID: 1452)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • Checks proxy server information

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)

    • Reads the software policy settings

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • slui.exe (PID: 4920)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • The sample compiled with english language support

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 6828)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)

    • Reads the machine GUID from the registry

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • Detects InnoSetup installer (YARA)

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 3140)

    • Compiled with Borland Delphi (YARA)

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 3140)

    • Creates files in the program directory

      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3272)
      • WerFault.exe (PID: 4784)
      • glogg.exe (PID: 6972)
      • glogg.exe (PID: 1452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:05:25 16:44:04
ZipCRC: 0x37480f1b
ZipCompressedSize: 2122579
ZipUncompressedSize: 2650064
ZipFileName: glogg_V-zjLO1.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe glogg_v-zjlo1.exe glogg_v-zjlo1.tmp no specs glogg_v-zjlo1.exe #BUNDLEINSTALLER glogg_v-zjlo1.tmp sabsi.exe sabsi.exe glogg.exe werfault.exe no specs werfault.exe no specs installer.exe installer.exe glogg.exe slui.exe no specs servicehost.exe uihost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\Desktop\glogg_V-zjLO1.exe" C:\Users\admin\Desktop\glogg_V-zjLO1.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
IMDownloader Installer
Exit code:
3221226525
Version:
5.3.12.3318
Modules
Images
c:\users\admin\desktop\glogg_v-zjlo1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1184"C:\Program Files\McAfee\Temp1689046537\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\Program Files\McAfee\Temp1689046537\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,1026
Modules
Images
c:\program files\mcafee\temp1689046537\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
1228"C:\Users\admin\AppData\Local\Temp\is-S8GQK.tmp\glogg_V-zjLO1.tmp" /SL5="$50250,1598543,845824,C:\Users\admin\Desktop\glogg_V-zjLO1.exe" /SPAWNWND=$40256 /NOTIFYWND=$702AA C:\Users\admin\AppData\Local\Temp\is-S8GQK.tmp\glogg_V-zjLO1.tmp
glogg_V-zjLO1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-s8gqk.tmp\glogg_v-zjlo1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1452"C:\Program Files\glogg\glogg.exe" C:\Program Files\glogg\glogg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\glogg\glogg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2040"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.865 CountryCode=DE /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Version:
4,1,1,1006
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3140"C:\Users\admin\AppData\Local\Temp\is-G26S2.tmp\glogg_V-zjLO1.tmp" /SL5="$702AA,1598543,845824,C:\Users\admin\Desktop\glogg_V-zjLO1.exe" C:\Users\admin\AppData\Local\Temp\is-G26S2.tmp\glogg_V-zjLO1.tmp—glogg_V-zjLO1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g26s2.tmp\glogg_v-zjlo1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3272C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1228 -s 908C:\Windows\SysWOW64\WerFault.exe—glogg_V-zjLO1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3304"C:\Program Files\McAfee\WebAdvisor\UIHost.exe" C:\Program Files\McAfee\WebAdvisor\uihost.exe—servicehost.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
MEDIUM
Description:
McAfee WebAdvisor(user level process)
Version:
4,1,1,1026
Modules
Images
c:\program files\mcafee\webadvisor\uihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4272C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4380"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
28 860
Read events
28 609
Write events
225
Delete events
26

Modification events

(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
43
Suspicious files
212
Text files
734
Unknown types
1

Dropped files

PID
Process
Filename
Type
5988glogg_V-zjLO1.exeC:\Users\admin\AppData\Local\Temp\is-S8GQK.tmp\glogg_V-zjLO1.tmpexecutable
MD5:C761BD83C58E48932AB9F509A52E3EA0
SHA256:867475EC4E746D78DA7DDD57628AE0559E695915D4E0F3A1B6F3A6EFDB464FE0
516glogg_V-zjLO1.exeC:\Users\admin\AppData\Local\Temp\is-G26S2.tmp\glogg_V-zjLO1.tmpexecutable
MD5:C761BD83C58E48932AB9F509A52E3EA0
SHA256:867475EC4E746D78DA7DDD57628AE0559E695915D4E0F3A1B6F3A6EFDB464FE0
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\is-S58I8.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
4380WinRAR.exeC:\Users\admin\Desktop\glogg_V-zjLO1.exeexecutable
MD5:56B8D994F4B47BDDCCE2AC0095CA72F0
SHA256:90EE622CAFAD9FDB2A059963655F879FB122BB436BCE32922C77A35458C70F91
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\Helper.dllexecutable
MD5:4EB0347E66FA465F602E52C03E5C0B4B
SHA256:C73E53CBB7B98FEAFE27CC7DE8FDAD51DF438E2235E91891461C5123888F73CC
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\is-7JK2A.tmpimage
MD5:F98EC019BB466EB2BE151343C594B515
SHA256:3E0A67735C8070D406AE71BA58134F23D234029F3E152CDA36BE894B98D6CAD5
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\mainlogo.pngimage
MD5:F98EC019BB466EB2BE151343C594B515
SHA256:3E0A67735C8070D406AE71BA58134F23D234029F3E152CDA36BE894B98D6CAD5
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\finish.pngimage
MD5:F765A844756B1831E35948EAB6648AA0
SHA256:9637A9463CB02ABB2ACE26DF81A7A101EA6F95D6112273C78C5FA23F3A1B19D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
27
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.33:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1228
glogg_V-zjLO1.tmp
GET
200
95.168.168.24:80
http://dl.jalecdn.com/US/glogg.exe
unknown
—
—
unknown
1452
glogg.exe
GET
200
51.15.94.113:80
http://gloggversion.bonnefon.org/latest
unknown
—
—
unknown
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.33:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.33
  • 23.216.77.18
  • 23.216.77.29
  • 23.216.77.27
  • 23.216.77.25
  • 23.216.77.21
  • 23.216.77.31
  • 23.216.77.30
  • 23.216.77.32
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.212.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.2
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
d2jys8y36d5a1s.cloudfront.net
  • 13.32.118.230
  • 13.32.118.192
  • 13.32.118.20
  • 13.32.118.85
whitelisted
static.download.it
  • 172.67.26.92
  • 104.22.56.224
  • 104.22.57.224
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
1228
glogg_V-zjLO1.tmp
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1228
glogg_V-zjLO1.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zip