File name:

obfuscated.exe

Full analysis: https://app.any.run/tasks/46f09f4a-a7a8-46a7-89da-66e379ded67d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 06, 2025, 14:21:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
iqvw64e-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
MD5:

47271B9E966F36556A157A3A1B041076

SHA1:

24F51C42F05EAC0970CE1B241ABF0504AB897FAF

SHA256:

D0A7E88F9C1798626EAFC46769C0A1479E792F102EAEEDA83E27AD21E821316C

SSDEEP:

3072:o5lxvXGBvkTnMX0BFS9uDr4cLkByhLVf1t5bHQng:2lxvX4vJX0zS8DrIByxtpHQng

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • ctfmon.exe (PID: 4468)
      • sihost.exe (PID: 4180)
      • RuntimeBroker.exe (PID: 5448)
      • svchost.exe (PID: 5048)
      • SearchApp.exe (PID: 5328)
      • RuntimeBroker.exe (PID: 5436)
      • firefox.exe (PID: 1976)
      • svchost.exe (PID: 6984)
      • dllhost.exe (PID: 2484)
      • default-browser-agent.exe (PID: 6896)
      • TextInputHost.exe (PID: 2772)
      • firefox.exe (PID: 4444)
      • svchost.exe (PID: 4204)
      • explorer.exe (PID: 4772)
      • UserOOBEBroker.exe (PID: 5936)
      • RuntimeBroker.exe (PID: 4376)
      • ApplicationFrameHost.exe (PID: 5096)
      • MusNotificationUx.exe (PID: 3720)
      • RuntimeBroker.exe (PID: 5224)
      • StartMenuExperienceHost.exe (PID: 5160)
      • svchost.exe (PID: 4248)
      • dllhost.exe (PID: 5604)

    • Runs injected code in another process

      • winupd.exe (PID: 4264)
      • slui.exe (PID: 1132)

    • Vulnerable driver has been detected

      • mapper.exe (PID: 7864)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • obfuscated.exe (PID: 1096)
      • TextInputHost.exe (PID: 2772)
      • winupd.exe (PID: 4264)
      • mapper.exe (PID: 7864)

    • Reads security settings of Internet Explorer

      • obfuscated.exe (PID: 1096)
      • winupd.exe (PID: 4264)
      • StartMenuExperienceHost.exe (PID: 5160)

    • Reads the date of Windows installation

      • obfuscated.exe (PID: 1096)

    • Starts itself from another location

      • obfuscated.exe (PID: 1096)

    • Drops a system driver (possible attempt to evade defenses)

      • winupd.exe (PID: 4264)

    • Creates or modifies Windows services

      • mapper.exe (PID: 7864)

    • Starts CMD.EXE for commands execution

      • mapper.exe (PID: 7864)

  • INFO

    • Checks proxy server information

      • obfuscated.exe (PID: 1096)
      • winupd.exe (PID: 4264)
      • StartMenuExperienceHost.exe (PID: 5160)
      • TextInputHost.exe (PID: 2772)
      • slui.exe (PID: 1132)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 3720)

    • Reads the computer name

      • obfuscated.exe (PID: 1096)
      • winupd.exe (PID: 4264)

    • Reads the software policy settings

      • obfuscated.exe (PID: 1096)
      • winupd.exe (PID: 4264)
      • StartMenuExperienceHost.exe (PID: 5160)
      • TextInputHost.exe (PID: 2772)
      • slui.exe (PID: 1132)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 3720)

    • Create files in a temporary directory

      • obfuscated.exe (PID: 1096)
      • mapper.exe (PID: 7864)

    • Reads the machine GUID from the registry

      • obfuscated.exe (PID: 1096)
      • TextInputHost.exe (PID: 2772)
      • StartMenuExperienceHost.exe (PID: 5160)
      • winupd.exe (PID: 4264)

    • Creates files or folders in the user directory

      • obfuscated.exe (PID: 1096)
      • StartMenuExperienceHost.exe (PID: 5160)
      • winupd.exe (PID: 4264)
      • TextInputHost.exe (PID: 2772)

    • Checks supported languages

      • obfuscated.exe (PID: 1096)
      • winupd.exe (PID: 4264)
      • mapper.exe (PID: 7864)

    • Process checks computer location settings

      • obfuscated.exe (PID: 1096)

    • The sample compiled with english language support

      • mapper.exe (PID: 7864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2036:06:27 19:29:42+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 9216
InitializedDataSize: 94720
UninitializedDataSize: -
EntryPoint: 0x226c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
29
Malicious processes
17
Suspicious processes
9

Behavior graph

Click at the process to see the details
start obfuscated.exe musnotificationux.exe winupd.exe THREAT mapper.exe conhost.exe no specs cmd.exe no specs slui.exe firefox.exe dllhost.exe textinputhost.exe sihost.exe svchost.exe svchost.exe runtimebroker.exe firefox.exe ctfmon.exe explorer.exe svchost.exe obfuscated.exe no specs applicationframehost.exe startmenuexperiencehost.exe runtimebroker.exe searchapp.exe runtimebroker.exe runtimebroker.exe dllhost.exe useroobebroker.exe default-browser-agent.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1096"C:\Users\admin\Desktop\obfuscated.exe" C:\Users\admin\Desktop\obfuscated.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\obfuscated.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1976"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe
default-browser-agent.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
2484C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2772"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
3720%systemroot%\system32\MusNotificationUx.exe ClearActiveNotificationsC:\Windows\System32\MusNotificationUx.exe
MusNotification.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MusNotificationUx.exe
Exit code:
0
Version:
10.0.19041.3693 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\musnotificationux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
4180sihost.exeC:\Windows\System32\sihost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Shell Infrastructure Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4204C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvcC:\Windows\System32\svchost.exe
services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4248C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserServiceC:\Windows\System32\svchost.exe
services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4264"C:\WINDOWS\system32\winupd.exe" C:\Windows\System32\winupd.exe
obfuscated.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\system32\winupd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
24 209
Read events
24 183
Write events
25
Delete events
1

Modification events

(PID) Process:(1096) obfuscated.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1096) obfuscated.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1096) obfuscated.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010011000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000001B0000000000000061007400740065006E00740069006F006E00630061006C00690066006F0072006E00690061002E0070006E0067003E002000200000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C000000120000000000000061006E006E00750061006C006D0061006C0065002E007200740066003E002000200000001000000000000000610072007400730066006500650073002E007200740066003E00200020000000140000000000000062007500730069006E00650073007300630065006C006C002E006A00700067003E002000200000000F00000000000000650067006D00650061006E0073002E007200740066003E002000200000001B0000000000000065006C0065006300740072006F006E006900630073006500750072006F007000650061006E002E006A00700067003E0020002000000013000000000000006D006500740068006F00640063006800650063006B002E007200740066003E0020002000000013000000000000006D006F006E00690074006F00720069006E00670067002E0070006E0067003E0020002000000015000000000000007400690074006C006500700075007200630068006100730065002E007200740066003E0020002000000012000000000000006F006200660075007300630061007400650064002E006500780065003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001100000000000000000000000000000000000000803F0000004008000000803F000040400900000000000000404003000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F00000000000000803F01000000000000000040020000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F070000000040000080401000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconNameVersion
Value:
1
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
86866A6800000000
(PID) Process:(5160) StartMenuExperienceHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5160) StartMenuExperienceHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CacheVersion
Value:
1
(PID) Process:(5160) StartMenuExperienceHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CacheLimit
Value:
51200
(PID) Process:(5160) StartMenuExperienceHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
11
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2772TextInputHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\winupd.exeexecutable
MD5:8D5F3A8AAA974201DFBA81E796389C61
SHA256:30DC15D3D5E14872F04883E203B2388CDBB996E832F9B37C3D73FAE20CD15729
1096obfuscated.exeC:\Windows\System32\winupd.exeexecutable
MD5:47271B9E966F36556A157A3A1B041076
SHA256:D0A7E88F9C1798626EAFC46769C0A1479E792F102EAEEDA83E27AD21E821316C
4444firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmpbinary
MD5:67C74ACA747B9719242F4392C44CBB8E
SHA256:F337D1806309645D9D86C75D2CCEE9008A5E396A106087D8E7EB972FD5918921
3720MusNotificationUx.exeC:\ProgramData\USOShared\Logs\User\NotificationUx.575f4e5e-2a7b-4ccb-af28-3f34ef37af5f.1.etlbinary
MD5:33EA04F7BA821137A2668EE4123FA682
SHA256:5E539F862D95140F76CDCF77834FA88FA9A5F6F1BCAD65C5C64AF2199B33F01B
1096obfuscated.exeC:\Users\admin\AppData\Local\Temp\spread.dllexecutable
MD5:968D322B3AD6FB6A8E0F3A9D2EC16779
SHA256:A6644F6D28FDCD0C25D443A0C1BC9E586E0A0808C20BCF64AC8A475556F4036E
1096obfuscated.exeC:\Windows\System32\spread.dllexecutable
MD5:968D322B3AD6FB6A8E0F3A9D2EC16779
SHA256:A6644F6D28FDCD0C25D443A0C1BC9E586E0A0808C20BCF64AC8A475556F4036E
5160StartMenuExperienceHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\winupd.exeexecutable
MD5:8D5F3A8AAA974201DFBA81E796389C61
SHA256:30DC15D3D5E14872F04883E203B2388CDBB996E832F9B37C3D73FAE20CD15729
4264winupd.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\mapper[1].exeexecutable
MD5:0F06B86EE5CBEFB966315EBBB1574468
SHA256:105E3F35565C4E514F0D32B5BCFFD96B4E3094D007C3CFD76F3A21E5A2382A0F
4444firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.binbinary
MD5:67C74ACA747B9719242F4392C44CBB8E
SHA256:F337D1806309645D9D86C75D2CCEE9008A5E396A106087D8E7EB972FD5918921
4264winupd.exeC:\Windows\System32\mapper.exeexecutable
MD5:0F06B86EE5CBEFB966315EBBB1574468
SHA256:105E3F35565C4E514F0D32B5BCFFD96B4E3094D007C3CFD76F3A21E5A2382A0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
154
TCP/UDP connections
44
DNS requests
17
Threats
51

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.29:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
104.21.57.147:443
https://cdn.starlab.sh/uploads/spread.dll
unknown
executable
57.0 Kb
—
5104
RUXIMICS.exe
GET
200
23.216.77.29:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5104
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
172.67.146.164:443
https://cdn.starlab.sh/uploads/winupd.exe
unknown
executable
104 Kb
—
—
—
GET
200
104.21.57.147:443
https://cdn.starlab.sh/uploads/winupd.exe
unknown
executable
104 Kb
—
—
—
GET
200
172.67.146.164:443
https://cdn.starlab.sh/uploads/mapper.exe
unknown
executable
137 Kb
—
—
—
GET
200
104.21.57.147:443
https://cdn.starlab.sh/uploads/ghost.sys
unknown
executable
7.00 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5104
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.29:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5104
RUXIMICS.exe
23.216.77.29:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5104
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.142
whitelisted
crl.microsoft.com
  • 23.216.77.29
  • 23.216.77.19
  • 23.216.77.20
  • 23.216.77.26
  • 23.216.77.6
  • 23.216.77.18
  • 23.216.77.7
  • 23.216.77.28
  • 23.216.77.8
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
cdn.starlab.sh
  • 104.21.57.147
  • 172.67.146.164
unknown
login.live.com
  • 20.190.160.128
  • 40.126.32.133
  • 20.190.160.67
  • 20.190.160.4
  • 20.190.160.66
  • 20.190.160.5
  • 20.190.160.130
  • 40.126.32.134
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed UA-CPU Header
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
—
—
Misc activity
ET HUNTING Suspicious Windows Executable CreateRemoteThread
—
—
Misc activity
ET HUNTING Suspicious Windows Executable WriteProcessMemory
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
obfuscated.exe