URL:

https://download.microsoft.com/download/b06a496e-9fbe-4d9a-b818-7214ffee4855/1.1.390.0/BingWallpaperInstaller.exe

Full analysis: https://app.any.run/tasks/a108acad-dd93-4933-9597-2a4b04986cb7
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 01, 2025, 21:55:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MD5:

858C0524F0E7BA26004DDC00A6661562

SHA1:

D1EF56E7C5BA9C2FB379D8796D844C027B42FD2A

SHA256:

C94BA2E2FEB12AAC04F36584AA0D996078D7797335AB61A2671F3D2B68FC98CD

SSDEEP:

3:N8SElyKRtR8L6cT8Bch2KShARjzSbWnME1xjEgXLNn:2SKTD8bMC2JhARjGeEgXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)
      • DefaultSetup.exe (PID: 732)

    • Changes the autorun value in the registry

      • BingWallpaper.exe (PID: 5408)
      • BingWallpaperInstaller.exe (PID: 8080)
      • DefaultSetup.exe (PID: 732)

    • Steals credentials from Web Browsers

      • BingWallpaper.exe (PID: 5408)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)

    • Reads security settings of Internet Explorer

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)
      • DefaultSetup.exe (PID: 732)

    • Process drops legitimate windows executable

      • BingWallpaperInstaller.exe (PID: 8080)

    • Reads the Internet Settings

      • BingWallpaper.exe (PID: 5408)

    • Reads settings of System Certificates

      • BingWallpaper.exe (PID: 5408)

    • Reads Mozilla Firefox installation path

      • BingWallpaper.exe (PID: 5408)

  • INFO

    • Checks supported languages

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)
      • UnInstDaemon.exe (PID: 664)
      • DefaultSetup.exe (PID: 732)

    • Process checks computer location settings

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)
      • UnInstDaemon.exe (PID: 664)
      • DefaultSetup.exe (PID: 732)

    • Disables trace logs

      • BingWallpaperInstaller.exe (PID: 8080)

    • Application launched itself

      • chrome.exe (PID: 6816)
      • chrome.exe (PID: 4304)
      • firefox.exe (PID: 3896)
      • firefox.exe (PID: 7912)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6816)

    • The sample compiled with english language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • Autorun file from Downloads

      • chrome.exe (PID: 1660)

    • Reads the computer name

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)
      • UnInstDaemon.exe (PID: 664)
      • DefaultSetup.exe (PID: 732)

    • Reads the machine GUID from the registry

      • BingWallpaperInstaller.exe (PID: 8080)
      • UnInstDaemon.exe (PID: 664)

    • Reads the software policy settings

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)
      • slui.exe (PID: 7788)
      • DefaultSetup.exe (PID: 732)
      • slui.exe (PID: 7728)

    • Checks proxy server information

      • BingWallpaperInstaller.exe (PID: 8080)
      • slui.exe (PID: 7728)

    • The sample compiled with chinese language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with japanese language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with french language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with Indonesian language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with czech language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with korean language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with spanish language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with german language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • Create files in a temporary directory

      • BingWallpaperInstaller.exe (PID: 8080)
      • BingWallpaper.exe (PID: 5408)

    • The sample compiled with bulgarian language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • The sample compiled with Italian language support

      • BingWallpaperInstaller.exe (PID: 8080)

    • Creates files or folders in the user directory

      • BingWallpaper.exe (PID: 5408)
      • BingWallpaperInstaller.exe (PID: 8080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
37
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bingwallpaperinstaller.exe bingwallpaper.exe uninstdaemon.exe no specs slui.exe chrome.exe no specs defaultsetup.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs chrome.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\AppData\Local\Temp\bwp300889d9-3aca-41b4-a345-209f91681334\UnInstDaemon.exe"C:\Users\admin\AppData\Local\Temp\bwp300889d9-3aca-41b4-a345-209f91681334\UnInstDaemon.exe—BingWallpaper.exe
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
UnInstDaemon
Version:
1.1.390.0
Modules
Images
c:\users\admin\appdata\local\temp\bwp300889d9-3aca-41b4-a345-209f91681334\uninstdaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
732 /c:"DefaultSetup.exe"C:\Users\admin\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe
BingWallpaperInstaller.exe
User:
admin
Company:
© 2025 Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DefaultSetup
Exit code:
0
Version:
2.0.3.1
Modules
Images
c:\users\admin\appdata\local\microsoft\defaultsetup\defaultsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
776"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2144 -prefMapHandle 2132 -prefsLen 31031 -prefMapSize 244629 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {628986a9-5679-4eac-845e-2913beff889a} 7912 "\\.\pipe\gecko-crash-server-pipe.7912" 1e546f81310 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5336 --field-trial-handle=1856,i,16574748394355246451,7782533555505962704,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1660"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4864 --field-trial-handle=1856,i,16574748394355246451,7782533555505962704,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2564"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1908 -parentBuildID 20240213221259 -prefsHandle 1832 -prefMapHandle 1816 -prefsLen 31031 -prefMapSize 244629 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a1bab3a-31a0-4dc5-a097-320768fad4a0} 7912 "\\.\pipe\gecko-crash-server-pipe.7912" 1e553feeb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
3896"C:\Program Files\Mozilla Firefox\firefox.exe" https://go.microsoft.com/fwlink/?linkid=2120579&partnerCode=W258&machineID=0996d0c4f03144f482ed9a516d377d6e&mkt=en-usC:\Program Files\Mozilla Firefox\firefox.exe—DefaultSetup.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
4304"C:\Program Files\Google\Chrome\Application\chrome.exe" https://go.microsoft.com/fwlink/?linkid=2128328&partnerCode=W258&machineID=0996d0c4f03144f482ed9a516d377d6e&extnID=ddojnmkongaimkdddgmcccldlfhokcfb&mkt=en-usC:\Program Files\Google\Chrome\Application\chrome.exe—DefaultSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4608"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2772 -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2916 -prefsLen 26911 -prefMapSize 244629 -jsInitHandle 1500 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdaf6131-3a8b-46f9-9088-b02d7f78a4c3} 7912 "\\.\pipe\gecko-crash-server-pipe.7912" 1e558dbfa10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5408"C:\Program Files\WindowsApps\Microsoft.BingWallpaper_1.1.390.0_x86__8wekyb3d8bbwe\BingWallpaper.exe" microsoft-bingwallpaper://launch/?supresswelcomescreen=trueC:\Program Files\WindowsApps\Microsoft.BingWallpaper_1.1.390.0_x86__8wekyb3d8bbwe\BingWallpaper.exe
BingWallpaperInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BingWallpaper
Version:
1.0.0.0
Modules
Images
c:\program files\windowsapps\microsoft.bingwallpaper_1.1.390.0_x86__8wekyb3d8bbwe\bingwallpaper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Total events
29 166
Read events
29 084
Write events
75
Delete events
7

Modification events

(PID) Process:(6816) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6816) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6816) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6816) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6816) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1660) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
010000000000000089BF4AE050A3DB01
(PID) Process:(8080) BingWallpaperInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\BingWallpaper
Operation:writeName:MachineID
Value:
0996d0c4f03144f482ed9a516d377d6e
(PID) Process:(8080) BingWallpaperInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Dispatcher
Operation:writeName:MachineID
Value:
0996d0c4f03144f482ed9a516d377d6e
(PID) Process:(8080) BingWallpaperInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\BingWallpaper
Operation:writeName:PartnerCode
Value:
W258
(PID) Process:(8080) BingWallpaperInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Dispatcher
Operation:writeName:PartnerCode
Value:
W258
Executable files
7
Suspicious files
263
Text files
71
Unknown types
1

Dropped files

PID
Process
Filename
Type
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c006.TMP —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c016.TMP —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c016.TMP —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c016.TMP —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c016.TMP —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c016.TMP —
MD5:—
SHA256:—
6816chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
179
DNS requests
172
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8080
BingWallpaperInstaller.exe
GET
200
64.236.11.218:80
http://g.ceipmsn.com/8SE/44?MI=0996d0c4f03144f482ed9a516d377d6e&LV=1.1.390.0&OS=6.2.9200.0&TE=40&TV=isW258%7Cpkbwi%7Ctmen-us%7Cci18a1bdc8-59eb-40a4-acd7-ea48276b9b99%7Cts1743544640151%7Crt10%7CevSetDefaultYesButtonClicked%7Cpt9
unknown
—
—
unknown
—
—
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6816
chrome.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8080
BingWallpaperInstaller.exe
GET
200
64.236.11.218:80
http://g.ceipmsn.com/8SE/44?MI=0996d0c4f03144f482ed9a516d377d6e&LV=1.1.390.0&OS=6.2.9200.0&TE=40&TV=isW258%7Cpkbwi%7Ctmen-us%7Cci18a1bdc8-59eb-40a4-acd7-ea48276b9b99%7Cts1743544603546%7Crt1%7CevInstallerLaunched%7Cpt9
unknown
—
—
unknown
6816
chrome.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
8080
BingWallpaperInstaller.exe
GET
200
64.236.11.218:80
http://g.ceipmsn.com/8SE/44?MI=0996d0c4f03144f482ed9a516d377d6e&LV=1.1.390.0&OS=6.2.9200.0&TE=40&TV=isW258%7Cpkbwi%7Ctmen-us%7Cci18a1bdc8-59eb-40a4-acd7-ea48276b9b99%7Cts1743544604655%7Crt2%7CevInstallationStarted%7Cpt9
unknown
—
—
unknown
8080
BingWallpaperInstaller.exe
GET
200
64.236.11.218:80
http://g.ceipmsn.com/8SE/44?MI=0996d0c4f03144f482ed9a516d377d6e&LV=1.1.390.0&OS=6.2.9200.0&TE=40&TV=pcW258%7Cpkbwi%7Ctmen-us%7Crt1%7Cat1%7Cvr1.1.390.0%7Cpt2
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.24.77.35:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6816
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7308
chrome.exe
184.30.24.206:443
download.microsoft.com
AKAMAI-AS
DE
whitelisted
7308
chrome.exe
172.217.218.84:443
accounts.google.com
GOOGLE
US
whitelisted
3216
svchost.exe
20.7.1.246:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7308
chrome.exe
142.250.184.228:443
www.google.com
GOOGLE
US
whitelisted
6816
chrome.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 184.24.77.35
  • 184.24.77.37
whitelisted
download.microsoft.com
  • 184.30.24.206
whitelisted
accounts.google.com
  • 172.217.218.84
whitelisted
client.wns.windows.com
  • 20.7.1.246
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.129
  • 40.126.31.128
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.1
  • 20.190.159.4
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
sb-ssl.google.com
  • 142.250.185.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.microsoft.com/download/b06a496e-9fbe-4d9a-b818-7214ffee4855/1.1.390.0/BingWallpaperInstaller.exe