File name:

picasa39-setup.exe

Full analysis: https://app.any.run/tasks/51335d72-83b7-47d4-ab0f-f62fea9c0704
Verdict: Malicious activity
Analysis date: November 25, 2024, 11:19:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

3DF3D3C125D3BB1A5BD55E88F9E48920

SHA1:

72F3E2F18E83D60EC657F03C341A3C1DF701C2A9

SHA256:

CC36161B6D8EA29528BED7D5883AD260CFC8D8E32825938C52E93C1A495C355B

SSDEEP:

98304:g9/r0QWnIYa6E4Ela4UDadSPa2Pf7zLQFJQlYqlt1F6PE4hr2o8MwSUZ0ItRg3KI:449uiw7B5jBvWR12qfhkCQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • PicasaPhotoViewer.exe (PID: 4872)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • picasa39-setup.exe (PID: 3876)

    • Starts application with an unusual extension

      • picasa39-setup.exe (PID: 3876)

    • The process creates files with name similar to system file names

      • picasa39-setup.exe (PID: 3876)

    • Executable content was dropped or overwritten

      • picasa39-setup.exe (PID: 3876)

    • Creates a software uninstall entry

      • picasa39-setup.exe (PID: 3876)

  • INFO

    • Create files in a temporary directory

      • picasa39-setup.exe (PID: 3876)

    • Creates files in the program directory

      • picasa39-setup.exe (PID: 3876)

    • Disables trace logs

      • GPhotos.scr (PID: 5092)

    • Creates files or folders in the user directory

      • GPhotos.scr (PID: 5092)

    • Checks proxy server information

      • GPhotos.scr (PID: 5092)

    • Checks supported languages

      • picasa39-setup.exe (PID: 3876)
      • Picasa3.exe (PID: 444)

    • Reads the computer name

      • picasa39-setup.exe (PID: 3876)

    • Manual execution by a user

      • Picasa3.exe (PID: 5616)

    • Application launched itself

      • msedge.exe (PID: 5876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:10:07 04:40:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x335a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.9.141.255
ProductVersionNumber: 3.9.141.255
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Installer for Picasa
CompanyName: Google
FileDescription: Installer for Picasa
FileVersion: 3.9.141.255
LegalCopyright: Copyright 2015, Google, Inc.
ProductName: Picasa
ProductVersion: 3.9.141.255
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
42
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start picasa39-setup.exe gphotos.scr picasa3.exe no specs picasa3.exe picasaphotoviewer.exe no specs iexplore.exe no specs iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs picasa39-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files (x86)\Google\Picasa3\Picasa3.exe" /registerC:\Program Files (x86)\Google\Picasa3\Picasa3.exe—picasa39-setup.exe
User:
admin
Company:
Google Inc.
Integrity Level:
HIGH
Description:
Picasa
Exit code:
0
Version:
3.9.141.255
Modules
Images
c:\program files (x86)\google\picasa3\picasa3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\imm32.dll
2076"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=8 -- "https://photos.google.com/apps"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3620"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5600 --field-trial-handle=2352,i,2420205418813147173,4179935578204851027,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3724"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3496 --field-trial-handle=2352,i,2420205418813147173,4179935578204851027,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3736"C:\Program Files\Internet Explorer\iexplore.exe" -nohome "http://picasa.google.com/support/bin/answer.py?hl=en&answer=93773"C:\Program Files\Internet Explorer\iexplore.exe—Picasa3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3832"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5332 --field-trial-handle=2352,i,2420205418813147173,4179935578204851027,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3840"C:\Users\admin\Desktop\picasa39-setup.exe" C:\Users\admin\Desktop\picasa39-setup.exe—explorer.exe
User:
admin
Company:
Google
Integrity Level:
MEDIUM
Description:
Installer for Picasa
Exit code:
3221226540
Version:
3.9.141.255
Modules
Images
c:\users\admin\desktop\picasa39-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3876"C:\Users\admin\Desktop\picasa39-setup.exe" C:\Users\admin\Desktop\picasa39-setup.exe
explorer.exe
User:
admin
Company:
Google
Integrity Level:
HIGH
Description:
Installer for Picasa
Exit code:
0
Version:
3.9.141.255
Modules
Images
c:\users\admin\desktop\picasa39-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3920"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2744 --field-trial-handle=2352,i,2420205418813147173,4179935578204851027,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4036"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4296 --field-trial-handle=2352,i,2420205418813147173,4179935578204851027,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
19 975
Read events
19 573
Write events
396
Delete events
6

Modification events

(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5092) GPhotos.scrKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GPhotos_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5092) GPhotos.scrKey:HKEY_USERS\.DEFAULT\Software\Google\Picasa\GBScreensaver_d\Preferences
Operation:writeName:curtheme25
Value:
burnstheme
(PID) Process:(5092) GPhotos.scrKey:HKEY_USERS\.DEFAULT\Software\Google\Picasa\GBScreensaver_d\Preferences
Operation:writeName:advanceinterval
Value:
3.0
(PID) Process:(5092) GPhotos.scrKey:HKEY_USERS\.DEFAULT\Software\Google\Picasa\GBScreensaver_d\Preferences
Operation:writeName:EnableRSSSources
Value:
0
Executable files
22
Suspicious files
327
Text files
587
Unknown types
13

Dropped files

PID
Process
Filename
Type
3876picasa39-setup.exeC:\Users\admin\AppData\Local\Temp\nsg66BE.tmp\NSIS_Picasa_Unicode.dllexecutable
MD5:BA1FAB5556089B2F83B816DDE35C6132
SHA256:9E95B4566EA243C0A6743B5B0626FCF18EC98E38415B62F94F6CBF38276D7FC4
3876picasa39-setup.exeC:\Users\admin\AppData\Local\Temp\nsg66BE.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\qtsupport.dllexecutable
MD5:73886A3846D300C89621A115CF1B70DF
SHA256:A898A0BF3F8396E6DBDFDED66F0F96B09A00A04B912F9CD4F6B70E399D7B8047
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\MovieThumb.exeexecutable
MD5:3436235E704354AA6374BF689E7078AA
SHA256:86EC3A8B305BFD4A63DC1CA9BD8319EC508A63966954E6FDCC4152E9D399B829
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\Picasa3i18n.dllexecutable
MD5:A7B28EFE1C5D15F3A3F99756AADCEA0E
SHA256:05B40C68BA874537A76A3C03CE094884E288A2C7055FB99329BAD3BC2104CF04
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\PicasaPhotoViewer.exeexecutable
MD5:69B20702DEBC005CD1DA0906B4A3C4F5
SHA256:4BD5F244C5EE6ADAB8D3F20654EB4D3B418CD214A8ABDF8FD4392310927C1413
3876picasa39-setup.exeC:\Users\admin\AppData\Local\Temp\nsg66BE.tmp\System.dllexecutable
MD5:3E6BF00B3AC976122F982AE2AADB1C51
SHA256:4FF9B2678D698677C5D9732678F9CF53F17290E09D053691AAC4CC6E6F595CBE
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\uninstall.exeexecutable
MD5:3A08977ADC09A57DF210E6966660046B
SHA256:002E9254E29D6DC9E760EA08BFC1A0DE4EBF887D4B4580DF0355EB44420D9CD0
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\npPicasa3.dllexecutable
MD5:BAA4AF6F2C77F7FA54368DE5C0018667
SHA256:1F9B11B901E42A5CBAF55BF306F2A05187D202B545485673138FC8E81F59048F
3876picasa39-setup.exeC:\Program Files (x86)\Google\Picasa3\Picasa3.exeexecutable
MD5:6AD50A491F52B1CBECE23B603037FBDF
SHA256:B4684FB49917BD97741802848A8B7EAC189A178DF56B7FCF5D0B078D892502A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
177
DNS requests
115
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4536
svchost.exe
GET
200
2.16.164.51:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.51:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5092
GPhotos.scr
GET
404
142.250.181.228:80
http://pack.google.com/gphotos?action=install&hl=en&gl=us&brand=GGLA&scrid=761AC691-F798-4E3F-A191-F75DD65D015C&v=(null)
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5616
Picasa3.exe
POST
200
142.250.184.206:80
http://clients2.google.com/service/update2
unknown
—
—
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
unknown
5616
Picasa3.exe
GET
200
142.250.185.97:80
http://picasa-readme.blogspot.com/feeds/posts/default
unknown
—
—
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=44&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1
unknown
binary
768 b
whitelisted
—
—
GET
200
13.107.253.45:443
https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable
unknown
binary
14.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4536
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.143:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4536
svchost.exe
2.16.164.51:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.51:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4536
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.143
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.137
  • 2.23.209.140
  • 2.23.209.144
  • 2.23.209.135
  • 2.23.209.150
  • 2.23.209.141
  • 2.23.209.183
  • 2.23.209.177
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.189
  • 2.23.209.161
  • 2.23.209.181
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.173
  • 2.23.209.166
  • 2.23.209.162
  • 2.23.209.175
  • 2.23.209.160
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.164.51
  • 2.16.164.18
  • 2.16.164.17
  • 2.16.164.106
  • 2.16.164.89
  • 2.16.164.99
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
pack.google.com
  • 142.250.181.228
whitelisted
clients2.google.com
  • 142.250.184.206
whitelisted
picasa.google.com
  • 142.250.185.68
whitelisted
photos.google.com
  • 142.250.185.238
whitelisted
picasa-readme.blogspot.com
  • 142.250.185.97
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
picasa39-setup.exe