File name:

NanoPhanoTool.exe

Full analysis: https://app.any.run/tasks/4d727cc3-dd1f-415f-b7d0-fd4c3291e7aa
Verdict: Malicious activity
Analysis date: December 11, 2024, 15:25:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
nodejs
obfuscated-js
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

6AE17B0BDDDA685EAA622CEF4BA2E805

SHA1:

8139F07B57A1D71B60D32CBA52167AA824AFAD2A

SHA256:

CD207B81505F13D46D94B08FB5130DDAE52BD1748856E6B474688E590933A718

SSDEEP:

393216:SgqoMmxIWo7SbYwWzv0Nv26ypNqLCvssOFCTiQi0PKwdtN2Zg2fA29/Oj58j:SgqoMmxZbJzo0C1I2iRwvNgg2fA29mjE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Unrestricted)

      • NanoTool.exe (PID: 6852)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • NanoPhanoTool.exe (PID: 6648)

    • Reads security settings of Internet Explorer

      • NanoPhanoTool.exe (PID: 6648)

    • Executable content was dropped or overwritten

      • NanoPhanoTool.exe (PID: 6648)

    • Process drops legitimate windows executable

      • NanoPhanoTool.exe (PID: 6648)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • NanoPhanoTool.exe (PID: 6648)

    • Starts CMD.EXE for commands execution

      • NanoTool.exe (PID: 6852)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6932)

    • Application launched itself

      • NanoTool.exe (PID: 6852)

    • Starts POWERSHELL.EXE for commands execution

      • NanoTool.exe (PID: 6852)

    • The process hides Powershell's copyright startup banner

      • NanoTool.exe (PID: 6852)

    • The process bypasses the loading of PowerShell profile settings

      • NanoTool.exe (PID: 6852)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7824)

  • INFO

    • The sample compiled with english language support

      • NanoPhanoTool.exe (PID: 6648)

    • Reads the computer name

      • NanoPhanoTool.exe (PID: 6648)
      • NanoTool.exe (PID: 6852)
      • NanoTool.exe (PID: 7108)
      • NanoTool.exe (PID: 3288)
      • NanoTool.exe (PID: 6800)
      • NanoTool.exe (PID: 7488)

    • Create files in a temporary directory

      • NanoPhanoTool.exe (PID: 6648)

    • Checks supported languages

      • NanoPhanoTool.exe (PID: 6648)
      • chcp.com (PID: 6988)
      • NanoTool.exe (PID: 7108)
      • NanoTool.exe (PID: 3288)
      • NanoTool.exe (PID: 7344)
      • NanoTool.exe (PID: 8400)
      • NanoTool.exe (PID: 6852)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6932)

    • Checks proxy server information

      • NanoTool.exe (PID: 6852)

    • Reads the machine GUID from the registry

      • NanoTool.exe (PID: 6852)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6744)
      • Taskmgr.exe (PID: 5192)
      • mmc.exe (PID: 4724)
      • mmc.exe (PID: 1216)
      • msedge.exe (PID: 6184)

    • Node.js compiler has been detected

      • NanoTool.exe (PID: 3288)
      • NanoTool.exe (PID: 6852)
      • NanoTool.exe (PID: 7108)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6744)
      • mmc.exe (PID: 1216)

    • The process uses the downloaded file

      • Taskmgr.exe (PID: 6744)

    • Sends debugging messages

      • mmc.exe (PID: 1216)

    • Application launched itself

      • msedge.exe (PID: 5872)
      • msedge.exe (PID: 6184)

    • Reads product name

      • NanoTool.exe (PID: 6852)

    • Reads Environment values

      • NanoTool.exe (PID: 6852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.9.6.0
ProductVersionNumber: 6.9.6.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: -
FileVersion: 7.1.0
LegalCopyright: Copyright © 2024 NanoTool
LegalTrademarks: Nano Pnato Tools (C)
ProductName: NanoTool
ProductVersion: 6.9.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
256
Monitored processes
128
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start nanophanotool.exe nanotool.exe cmd.exe no specs conhost.exe no specs chcp.com no specs nanotool.exe no specs nanotool.exe no specs taskmgr.exe no specs taskmgr.exe mmc.exe no specs mmc.exe nanotool.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs nanotool.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs nanotool.exe no specs nanotool.exe no specs cmd.exe no specs conhost.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1080"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4724 --field-trial-handle=2272,i,2036238937888113685,4295111176528505544,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1080\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1152"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2296,i,13491400277050692380,2177388995329882570,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
1216"C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\taskschd.msc" /sC:\Windows\System32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
10.0.19041.1 (WinBuild.160101.0800)
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2296,i,13491400277050692380,2177388995329882570,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1344"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=2272,i,2036238937888113685,4295111176528505544,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1916\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3496 --field-trial-handle=2272,i,2036238937888113685,4295111176528505544,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
2152"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5068 --field-trial-handle=2296,i,13491400277050692380,2177388995329882570,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
2160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7484 --field-trial-handle=2272,i,2036238937888113685,4295111176528505544,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
45
Suspicious files
937
Text files
206
Unknown types
44

Dropped files

PID
Process
Filename
Type
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\app-64.7z —
MD5:—
SHA256:—
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\locales\ar.pakpgc
MD5:47A6D10B4112509852D4794229C0A03B
SHA256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\locales\bn.pakpgc
MD5:5CDD07FA357C846771058C2DB67EB13B
SHA256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\locales\ca.pakbinary
MD5:D259469E94F2ADF54380195555154518
SHA256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\locales\de.pakpgc
MD5:8E6654B89ED4C1DC02E1E2D06764805A
SHA256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
6648NanoPhanoTool.exeC:\Users\admin\AppData\Local\Temp\nsl9908.tmp\7z-out\locales\es-419.pakpgc
MD5:7F6696CC1E71F84D9EC24E9DC7BD6345
SHA256:D1F17508F3A0106848C48A240D49A943130B14BD0FEB5ED7AE89605C7B7017D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
118
DNS requests
31
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2396
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
304
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6748
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6748
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6300
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6100
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2396
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.209.183:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2396
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.6:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.74.206
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
www.bing.com
  • 92.123.104.6
  • 92.123.104.10
  • 92.123.104.13
  • 92.123.104.17
  • 92.123.104.9
  • 92.123.104.14
  • 92.123.104.5
  • 92.123.104.18
  • 92.123.104.12
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.173
  • 2.23.209.166
  • 2.23.209.186
  • 2.23.209.158
  • 2.23.209.189
  • 2.23.209.183
  • 2.23.209.162
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.73
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.213.170.81
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.google.com
  • 142.250.185.228
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
1344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
1344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
NanoPhanoTool.exe