File name:

iExplorerSetup.exe

Full analysis: https://app.any.run/tasks/205ad49e-d49b-449d-b254-ea7ee26997f5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 30, 2025, 21:31:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E1A35B6BFCBA5E12C1E673F5E54C2FF3

SHA1:

C3E329B1B652020BA67B98AFA7185B41B8D67137

SHA256:

C1DCDA62D81922B3ADA03F772864F3C4A37FB2631C2CCF43E349B14AF94AF627

SSDEEP:

12288:0DnvivRUO3vdMn3y132afS8FsDdFLeMb01JQntLOCOge1Z:0DKvj3k3yRFsfLemOrZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 7500)

    • Potential Corporate Privacy Violation

      • dfsvc.exe (PID: 7500)

    • Executable content was dropped or overwritten

      • dfsvc.exe (PID: 7500)

    • Process requests binary or script from the Internet

      • dfsvc.exe (PID: 7500)

    • Reads the date of Windows installation

      • dfsvc.exe (PID: 7500)

    • The process drops C-runtime libraries

      • dfsvc.exe (PID: 7500)

    • Searches for installed software

      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Process drops legitimate windows executable

      • dfsvc.exe (PID: 7500)

    • Creates a software uninstall entry

      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

  • INFO

    • Create files in a temporary directory

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Creates files or folders in the user directory

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • The sample compiled with english language support

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)

    • Reads the computer name

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Checks supported languages

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Checks proxy server information

      • iExplorerSetup.exe (PID: 7452)
      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Reads the machine GUID from the registry

      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Reads Environment values

      • dfsvc.exe (PID: 7500)

    • Disables trace logs

      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 7500)

    • Reads the software policy settings

      • dfsvc.exe (PID: 7500)
      • iExplorer.exe (PID: 5956)

    • SQLite executable

      • dfsvc.exe (PID: 7500)

    • Process checks computer location settings

      • dfsvc.exe (PID: 7500)

    • Application launched itself

      • msedge.exe (PID: 6964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:06 02:16:55+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.1
CodeSize: 374784
InitializedDataSize: 167424
UninitializedDataSize: -
EntryPoint: 0x35267
OSVersion: 5.1
ImageVersion: 10
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 15.0.27005.2
ProductVersionNumber: 15.0.27005.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: -
FileDescription: Setup
FileVersion: 15.0.27005.2 built by: D15REL
InternalName: setup.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: setup.exe
ProductName: -
ProductVersion: 15.0.27005.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
25
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplorersetup.exe dfsvc.exe sppextcomobj.exe no specs slui.exe no specs iexplorer.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1676"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1912"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=5040 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4068"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4436"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5044 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5344"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5956"C:\Users\admin\AppData\Local\Apps\2.0\K6JJDH0X.HBH\9BD98D5P.Z7C\iexp..tion_9635013f8df187ee_0004.0006_01ea4e0c47853d9a\iExplorer.exe" C:\Users\admin\AppData\Local\Apps\2.0\K6JJDH0X.HBH\9BD98D5P.Z7C\iexp..tion_9635013f8df187ee_0004.0006_01ea4e0c47853d9a\iExplorer.exe
dfsvc.exe
User:
admin
Company:
Macroplant LLC
Integrity Level:
MEDIUM
Description:
iExplorer
Version:
4.6.0.0
Modules
Images
c:\users\admin\appdata\local\apps\2.0\k6jjdh0x.hbh\9bd98d5p.z7c\iexp..tion_9635013f8df187ee_0004.0006_01ea4e0c47853d9a\iexplorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5984"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4116 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x26c,0x320,0x324,0x274,0x32c,0x7ffc81a95fd8,0x7ffc81a95fe4,0x7ffc81a95ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5020 --field-trial-handle=2384,i,10110435411760256238,9546042509165996074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6964"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://helpdesk.macroplant.com/hc/en-us/articles/360018856454-My-device-isn-t-appearing-in-iExplorer-?utm_source=iExplorer%28PC%29%204.6.0.0&utm_medium=desktop+app&utm_campaign=Welcome Tab&utm_nooverride=1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
iExplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
13 658
Read events
11 975
Write events
1 437
Delete events
246

Modification events

(PID) Process:(7452) iExplorerSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7452) iExplorerSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7452) iExplorerSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7500) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:writeName:ComponentStore_RandomString
Value:
45RK8PQZ1T6LNNOV3TV71CE9
(PID) Process:(7500) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:delete valueName:ComponentStore_RandomString
Value:
45RK8PQZ1T6LNNOV3TV71CE9
(PID) Process:(7500) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:delete keyName:(default)
Value:
(PID) Process:(7500) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:writeName:ComponentStore_RandomString
Value:
K6JJDH0XHBH9BD98D5PZ7CQ8
(PID) Process:(7500) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager
Operation:writeName:StateStore_RandomString
Value:
1ZT8DLJP3M039RTO5LBAYQLD
(PID) Process:(7500) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7500) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
223
Suspicious files
159
Text files
266
Unknown types
0

Dropped files

PID
Process
Filename
Type
7500dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_B3F0B5EE032203242B38E68FDACEDD41binary
MD5:308C101AC11020725C7CAA7F4351FB91
SHA256:DAECD8DFC8F9C2E2C5FC7E7A7B6E8CB7D1F2692CD92B12CB12528C2CACD5D5FA
7500dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\BG2EEV6L.LNB\J5OXA40R.ANR.applicationxml
MD5:75300A31D40197CD6094E06416B1F21C
SHA256:B0131B4E7446740BF546589A06EBBEB0673C21F3291F2BC57A91E91872DE1D12
7500dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\XZ7BJA8R.J2O\ENCPR34D.Y1O\iExplorer.exe.manifestxml
MD5:5FF3335EF561F2108B37787ADCFB7C50
SHA256:E34A40077CAE4CB7D4C570627739570A57069E882E5CFFB25FFF7330F1306716
7500dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1binary
MD5:1B446947B2F60AA6AE4CBEB9D0291EB1
SHA256:54A8C2757B6D1742AD2C17F48CEE0FD8600918E83229DB1542556C570BC3A7A4
7500dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1binary
MD5:7E5E9912DE7A985FF6257B5E3005DE2C
SHA256:EC0BDEA0FCC54BE0A302CAC5A2513186CCD5A9E1BD9DE7C8DD81CE1773141571
7452iExplorerSetup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\iExplorer[1].applicationxml
MD5:75300A31D40197CD6094E06416B1F21C
SHA256:B0131B4E7446740BF546589A06EBBEB0673C21F3291F2BC57A91E91872DE1D12
7452iExplorerSetup.exeC:\Users\admin\AppData\Local\Temp\VSDB4DB.tmp\install.logbinary
MD5:D900BA5CF099D0950A1085288F8DD2D4
SHA256:ED95CD80246CEE544CDD1702A423DDB78EF975F56C8B2B7F89C287ED4E0DF3F2
7500dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\XZ7BJA8R.J2O\ENCPR34D.Y1O\iExplorer.icoimage
MD5:AFFCB18F27F85720F46D23C563F40E24
SHA256:FB449C5DBA1F44003F5A178898FCB08668B55D20A858A8A4F35B39EA1C43CC25
7500dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\XZ7BJA8R.J2O\ENCPR34D.Y1O\Images\ie-2tail-xp-icon.icoimage
MD5:D370B13A71D0EF192923DC96EBFF984F
SHA256:50B83217D8E4E93C8DC2C0F622A6289DDA19A1C647F0C9A5BADEE977BE9A85F6
7500dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\XZ7BJA8R.J2O\ENCPR34D.Y1O\FolderIcon2.icoimage
MD5:8571659FA41DB61A421F16DB3586B573
SHA256:36F19B835B7249B93593F0FDB1DEC981AB9054F65E36C784C12B10A5DA72306F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
129
TCP/UDP connections
68
DNS requests
62
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/CBFSInstaller/CBFSInstall.exe.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/iExplorer.ico.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/notices.html.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/CBFSInstaller/cbfs.cab.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/iExplorer.exe.config.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/x64/SQLite.Interop.dll.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/CBFSInstaller/CBFSNet.dll.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/IE3-EULA.txt.deploy
unknown
—
—
whitelisted
7500
dfsvc.exe
GET
200
104.21.47.35:80
http://iexplorer-windows.macroplant.com/Application%20Files/iExplorer_4_6_0_0/Images/ie-2tail-xp-icon.ico.deploy
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7452
iExplorerSetup.exe
104.21.47.35:80
iexplorer-windows.macroplant.com
CLOUDFLARENET
—
whitelisted
7500
dfsvc.exe
104.21.47.35:80
iexplorer-windows.macroplant.com
CLOUDFLARENET
—
whitelisted
—
—
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
18.66.147.48:80
ocsps.ssl.com
AMAZON-02
US
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 216.58.212.142
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
iexplorer-windows.macroplant.com
  • 104.21.47.35
  • 172.67.170.89
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
ocsps.ssl.com
  • 18.66.147.48
  • 18.66.147.89
  • 18.66.147.87
  • 18.66.147.75
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.130
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.2
  • 20.190.159.23
  • 20.190.159.71
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted

Threats

PID
Process
Class
Message
7500
dfsvc.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7500
dfsvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite.interop.dll - Possible Infostealer Activity
7500
dfsvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite.interop.dll - Possible Infostealer Activity
7500
dfsvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for bouncycastle.crypto.dll - Possible Infostealer Activity
7500
dfsvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for system.data.sqlite.dll - Possible Infostealer Activity
7500
dfsvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for newtonsoft.json.dll - Possible Infostealer Activity
7464
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7464
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7464
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7464
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
iExplorerSetup.exe