File name:

MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zip

Full analysis: https://app.any.run/tasks/ef611bc3-08d0-4c6e-9e23-7cf1139eed4a
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 25, 2025, 17:28:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
bundleinstaller
adware
innosetup
loader
arch-exec
inno
installer
delphi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E678C0CA8B00D9EB966A8114445DD69D

SHA1:

730AC2764FF65578003CD30583086FEEC23C093C

SHA256:

C17B20AA4210CB437FDBBA9EE282A4B6E09A02EDCEFE9AB8DA577C88D6BCB10E

SSDEEP:

98304:8blFWZFD494CStK9vp0BhGO2Nc/hUNhd7LjajB6iQ5zfslxb/huho/I2G51J/i4x:2HqIrz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bundleinstaller mutex has been found

      • glogg_V-zjLO1.tmp (PID: 1228)

    • INNOSETUP has been detected (SURICATA)

      • glogg_V-zjLO1.tmp (PID: 1228)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • glogg_V-zjLO1.tmp (PID: 3140)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 1184)
      • uihost.exe (PID: 3304)

    • Executable content was dropped or overwritten

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 6828)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)

    • Reads the Windows owner or organization settings

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Potential Corporate Privacy Violation

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Process requests binary or script from the Internet

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Access to an unwanted program domain was detected

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 5360)
      • servicehost.exe (PID: 6816)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)

    • Executes application which crashes

      • glogg_V-zjLO1.tmp (PID: 1228)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • glogg.exe (PID: 6972)

    • Creates a software uninstall entry

      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)

    • The process creates files with name similar to system file names

      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)

    • Working with threads in the GNU C Compiler (GCC) libraries related mutex has been found

      • glogg.exe (PID: 1452)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 1184)

    • Process drops legitimate windows executable

      • installer.exe (PID: 1184)

    • Executes as Windows Service

      • servicehost.exe (PID: 6816)

    • Reads Mozilla Firefox installation path

      • servicehost.exe (PID: 6816)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4380)

    • Create files in a temporary directory

      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)

    • Manual execution by a user

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg.exe (PID: 1452)

    • Reads the computer name

      • glogg_V-zjLO1.tmp (PID: 3140)
      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 1184)
      • glogg.exe (PID: 1452)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • Checks supported languages

      • glogg_V-zjLO1.tmp (PID: 1228)
      • glogg_V-zjLO1.exe (PID: 5988)
      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 3140)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 6828)
      • glogg.exe (PID: 1452)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • Process checks computer location settings

      • glogg_V-zjLO1.tmp (PID: 3140)
      • glogg_V-zjLO1.tmp (PID: 1228)

    • Reads the machine GUID from the registry

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • The sample compiled with english language support

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)

    • Checks proxy server information

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)

    • Creates files in the program directory

      • saBSI.exe (PID: 5360)
      • saBSI.exe (PID: 2040)
      • glogg.exe (PID: 6972)
      • installer.exe (PID: 6828)
      • installer.exe (PID: 1184)
      • servicehost.exe (PID: 6816)

    • Detects InnoSetup installer (YARA)

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 3140)

    • Compiled with Borland Delphi (YARA)

      • glogg_V-zjLO1.exe (PID: 516)
      • glogg_V-zjLO1.tmp (PID: 3140)

    • Reads the software policy settings

      • glogg_V-zjLO1.tmp (PID: 1228)
      • saBSI.exe (PID: 2040)
      • saBSI.exe (PID: 5360)
      • installer.exe (PID: 1184)
      • slui.exe (PID: 4920)
      • servicehost.exe (PID: 6816)
      • uihost.exe (PID: 3304)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3272)
      • WerFault.exe (PID: 4784)
      • glogg.exe (PID: 6972)
      • glogg.exe (PID: 1452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:05:25 16:44:04
ZipCRC: 0x37480f1b
ZipCompressedSize: 2122579
ZipUncompressedSize: 2650064
ZipFileName: glogg_V-zjLO1.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe glogg_v-zjlo1.exe glogg_v-zjlo1.tmp no specs glogg_v-zjlo1.exe #BUNDLEINSTALLER glogg_v-zjlo1.tmp sabsi.exe sabsi.exe glogg.exe werfault.exe no specs werfault.exe no specs installer.exe installer.exe glogg.exe slui.exe no specs servicehost.exe uihost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\Desktop\glogg_V-zjLO1.exe" C:\Users\admin\Desktop\glogg_V-zjLO1.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
IMDownloader Installer
Exit code:
3221226525
Version:
5.3.12.3318
Modules
Images
c:\users\admin\desktop\glogg_v-zjlo1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1184"C:\Program Files\McAfee\Temp1689046537\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\Program Files\McAfee\Temp1689046537\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,1026
Modules
Images
c:\program files\mcafee\temp1689046537\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
1228"C:\Users\admin\AppData\Local\Temp\is-S8GQK.tmp\glogg_V-zjLO1.tmp" /SL5="$50250,1598543,845824,C:\Users\admin\Desktop\glogg_V-zjLO1.exe" /SPAWNWND=$40256 /NOTIFYWND=$702AA C:\Users\admin\AppData\Local\Temp\is-S8GQK.tmp\glogg_V-zjLO1.tmp
glogg_V-zjLO1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-s8gqk.tmp\glogg_v-zjlo1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1452"C:\Program Files\glogg\glogg.exe" C:\Program Files\glogg\glogg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\glogg\glogg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2040"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.865 CountryCode=DE /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Version:
4,1,1,1006
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3140"C:\Users\admin\AppData\Local\Temp\is-G26S2.tmp\glogg_V-zjLO1.tmp" /SL5="$702AA,1598543,845824,C:\Users\admin\Desktop\glogg_V-zjLO1.exe" C:\Users\admin\AppData\Local\Temp\is-G26S2.tmp\glogg_V-zjLO1.tmp—glogg_V-zjLO1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
3221226525
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g26s2.tmp\glogg_v-zjlo1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3272C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1228 -s 908C:\Windows\SysWOW64\WerFault.exe—glogg_V-zjLO1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3304"C:\Program Files\McAfee\WebAdvisor\UIHost.exe" C:\Program Files\McAfee\WebAdvisor\uihost.exe—servicehost.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
MEDIUM
Description:
McAfee WebAdvisor(user level process)
Version:
4,1,1,1026
Modules
Images
c:\program files\mcafee\webadvisor\uihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4272C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4380"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
28 860
Read events
28 609
Write events
225
Delete events
26

Modification events

(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
43
Suspicious files
212
Text files
734
Unknown types
1

Dropped files

PID
Process
Filename
Type
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\WebAdvisor.pngimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\Helper.dllexecutable
MD5:4EB0347E66FA465F602E52C03E5C0B4B
SHA256:C73E53CBB7B98FEAFE27CC7DE8FDAD51DF438E2235E91891461C5123888F73CC
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\error.pngimage
MD5:FE65D5490209F8C8D3725130F1191AAF
SHA256:06F657FEBCFCEBCE3668246590E1A06B6737B8C26801CB3D98F0E6B30860BB8E
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\is-S58I8.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\prod0.zipcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
1228glogg_V-zjLO1.tmpC:\Users\admin\Downloads\glogg.exeexecutable
MD5:1F71C2DA992A77ADC264F6173F2005D6
SHA256:08FE13B713327BEF93298B6D11717A93BBAA9D49165995BE93F4A3282E76B22F
5360saBSI.exeC:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00000057003F001D0006.txttext
MD5:66A3F99371AC632418D215A1738903ED
SHA256:0727EABF3E25295FC7B9D4B49BF38AC1695DB85C04E757E578097523B1062687
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\prod0compressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\is-SV7JV.tmpcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
1228glogg_V-zjLO1.tmpC:\Users\admin\AppData\Local\Temp\is-3LINI.tmp\is-7JK2A.tmpimage
MD5:F98EC019BB466EB2BE151343C594B515
SHA256:3E0A67735C8070D406AE71BA58134F23D234029F3E152CDA36BE894B98D6CAD5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
27
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.33:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1228
glogg_V-zjLO1.tmp
GET
200
95.168.168.24:80
http://dl.jalecdn.com/US/glogg.exe
unknown
—
—
unknown
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1452
glogg.exe
GET
200
51.15.94.113:80
http://gloggversion.bonnefon.org/latest
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.33:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.33
  • 23.216.77.18
  • 23.216.77.29
  • 23.216.77.27
  • 23.216.77.25
  • 23.216.77.21
  • 23.216.77.31
  • 23.216.77.30
  • 23.216.77.32
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.212.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.2
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
d2jys8y36d5a1s.cloudfront.net
  • 13.32.118.230
  • 13.32.118.192
  • 13.32.118.20
  • 13.32.118.85
whitelisted
static.download.it
  • 172.67.26.92
  • 104.22.56.224
  • 104.22.57.224
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
1228
glogg_V-zjLO1.tmp
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1228
glogg_V-zjLO1.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_22b5a2fd443e9ecd548c7b87490f736d67c7e850.zip