File name:

Activator.exe

Full analysis: https://app.any.run/tasks/f7e9e827-5f33-4152-b588-fa314126d735
Verdict: Malicious activity
Analysis date: May 16, 2025, 02:11:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

063E6D3B5C4C8A35D0A12BD6D25176F9

SHA1:

203DF188A8922CB75AD6BBB5232C40B9DCEB8BFF

SHA256:

DDA1582FCDF7355BB64D7029F6C8C92F7768D93FA5F8921AF38D63A1BEBF5E3F

SSDEEP:

12288:l+Qz1ml4GzNM2zcUs0wdaE8UrJac8dqVH6sA5fUrvvD8GaWdeA7X2zSrmm1eMNoc:lmlZMuxs1f538sA5crYGaWcmX5feHqx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ProcessLasso.exe (PID: 684)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Patch.exe (PID: 8096)
      • Activator.exe (PID: 7192)

    • Creates file in the systems drive root

      • Activator.exe (PID: 7192)

    • Executable content was dropped or overwritten

      • processlassosetup64.exe (PID: 8148)
      • Patch.exe (PID: 8096)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • processlassosetup64.exe (PID: 8148)

    • There is functionality for taking screenshot (YARA)

      • processlassosetup64.exe (PID: 8148)
      • ProcessLasso.exe (PID: 684)
      • Activator.exe (PID: 7192)

    • The process creates files with name similar to system file names

      • processlassosetup64.exe (PID: 8148)

    • Creates a software uninstall entry

      • processlassosetup64.exe (PID: 8148)

    • Executes as Windows Service

      • srvstub.exe (PID: 5812)

    • The process executes via Task Scheduler

      • bitsumsessionagent.exe (PID: 5964)

  • INFO

    • Checks supported languages

      • Activator.exe (PID: 7192)
      • Patch.exe (PID: 8096)
      • InstallHelper.exe (PID: 6540)
      • processlassosetup64.exe (PID: 8148)
      • InstallHelper.exe (PID: 7428)
      • InstallHelper.exe (PID: 5324)
      • InstallHelper.exe (PID: 7608)
      • InstallHelper.exe (PID: 7640)
      • InstallHelper.exe (PID: 7480)
      • InstallHelper.exe (PID: 8020)
      • InstallHelper.exe (PID: 7904)
      • srvstub.exe (PID: 5812)
      • InstallHelper.exe (PID: 7700)
      • InstallHelper.exe (PID: 856)
      • ProcessGovernor.exe (PID: 6108)

    • The sample compiled with english language support

      • Activator.exe (PID: 7192)
      • processlassosetup64.exe (PID: 8148)
      • Patch.exe (PID: 8096)

    • Application launched itself

      • firefox.exe (PID: 8132)
      • firefox.exe (PID: 8152)

    • Manual execution by a user

      • Patch.exe (PID: 7788)
      • Patch.exe (PID: 8096)
      • processlassosetup64.exe (PID: 8148)
      • processlassosetup64.exe (PID: 6344)
      • firefox.exe (PID: 8132)
      • ProcessLassoLauncher.exe (PID: 5436)

    • Checks proxy server information

      • slui.exe (PID: 8056)

    • Reads the software policy settings

      • slui.exe (PID: 8056)
      • slui.exe (PID: 7272)

    • Reads the computer name

      • Patch.exe (PID: 8096)
      • processlassosetup64.exe (PID: 8148)
      • InstallHelper.exe (PID: 6540)
      • InstallHelper.exe (PID: 7428)
      • InstallHelper.exe (PID: 5324)
      • InstallHelper.exe (PID: 7608)
      • InstallHelper.exe (PID: 7640)
      • InstallHelper.exe (PID: 7480)
      • InstallHelper.exe (PID: 856)
      • InstallHelper.exe (PID: 8020)
      • InstallHelper.exe (PID: 7904)
      • srvstub.exe (PID: 5812)
      • ProcessGovernor.exe (PID: 6108)
      • InstallHelper.exe (PID: 7700)
      • Activator.exe (PID: 7192)

    • Compiled with Borland Delphi (YARA)

      • Patch.exe (PID: 8096)
      • slui.exe (PID: 8056)
      • processlassosetup64.exe (PID: 8148)
      • ProcessLasso.exe (PID: 684)
      • Activator.exe (PID: 7192)

    • Create files in a temporary directory

      • processlassosetup64.exe (PID: 8148)

    • Creates files in the program directory

      • processlassosetup64.exe (PID: 8148)
      • InstallHelper.exe (PID: 7640)
      • InstallHelper.exe (PID: 8020)
      • ProcessGovernor.exe (PID: 6108)

    • Reads CPU info

      • InstallHelper.exe (PID: 6540)
      • InstallHelper.exe (PID: 5324)
      • InstallHelper.exe (PID: 7608)
      • InstallHelper.exe (PID: 7640)
      • InstallHelper.exe (PID: 7480)
      • InstallHelper.exe (PID: 7428)
      • InstallHelper.exe (PID: 856)
      • InstallHelper.exe (PID: 8020)
      • InstallHelper.exe (PID: 7904)
      • ProcessGovernor.exe (PID: 6108)
      • InstallHelper.exe (PID: 7700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:04:20 12:16:33+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 647168
InitializedDataSize: 57344
UninitializedDataSize: 1204224
EntryPoint: 0x1c3870
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: RadiXX11
FileDescription: Activator for Bitsum CPU optimizers
FileVersion: 1.0.0.0
InternalName: Activator.exe
LegalCopyright: © 2017, RadiXX11
LegalTrademarks: -
OriginalFileName: Activator.exe
ProductName: Bitsum Optimizers Activator
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
37
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start activator.exe sppextcomobj.exe no specs slui.exe slui.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs patch.exe no specs patch.exe processlassosetup64.exe no specs processlassosetup64.exe installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs srvstub.exe no specs processgovernor.exe no specs installhelper.exe no specs rundll32.exe no specs processlassolauncher.exe no specs processlasso.exe bitsumsessionagent.exe no specs activator.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\Process Lasso\ProcessLasso.exe" "C:\Program Files\Process Lasso\ProcessLassoLauncher.exe" "/showwindow" "/nodelay"C:\Program Files\Process Lasso\ProcessLasso.exe
ProcessLassoLauncher.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso
Version:

Modules
Images
c:\program files\process lasso\processlasso.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
856"C:\Program Files\Process Lasso\InstallHelper.exe" /enable_update_checkC:\Program Files\Process Lasso\InstallHelper.exe—processlassosetup64.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
1
Version:

Modules
Images
c:\program files\process lasso\installhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1388"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5060 -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 4260 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1536 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9e34461-cf47-4f9f-9d62-6234b5ac6b85} 8152 "\\.\pipe\gecko-crash-server-pipe.8152" 185e9839310 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3304"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1900 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21093f85-8d63-4c74-a7eb-066422d9a768} 8152 "\\.\pipe\gecko-crash-server-pipe.8152" 185e62eca10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
4040"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9582dc4a-b71c-4ef1-a050-747333b387df} 8152 "\\.\pipe\gecko-crash-server-pipe.8152" 185d937fb10 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
4528"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 6 -isForBrowser -prefsHandle 5912 -prefMapHandle 3056 -prefsLen 31366 -prefMapSize 244583 -jsInitHandle 1536 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f07339c8-3a11-49b4-87d1-9a9a99c7e987} 8152 "\\.\pipe\gecko-crash-server-pipe.8152" 185ede83690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
5244C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5324"C:\Program Files\Process Lasso\InstallHelper.exe" /powerinstallC:\Program Files\Process Lasso\InstallHelper.exe—processlassosetup64.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
0
Version:

Modules
Images
c:\program files\process lasso\installhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5392"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2780 -childID 1 -isForBrowser -prefsHandle 2756 -prefMapHandle 2752 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1536 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b574da43-0d8b-427b-8025-83cbc7b174e7} 8152 "\\.\pipe\gecko-crash-server-pipe.8152" 185eaf41f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
5436"C:\Program Files\Process Lasso\ProcessLassoLauncher.exe" /showwindow /nodelayC:\Program Files\Process Lasso\ProcessLassoLauncher.exe—explorer.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
MEDIUM
Description:
Process Lasso Launcher
Exit code:
0
Version:

Modules
Images
c:\program files\process lasso\processlassolauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
23 892
Read events
23 698
Write events
188
Delete events
6

Modification events

(PID) Process:(7192) Activator.exeKey:HKEY_CURRENT_USER\SOFTWARE\ProcessLasso
Operation:writeName:EDD
Value:
1
(PID) Process:(7192) Activator.exeKey:HKEY_CURRENT_USER\SOFTWARE\ProcessLasso
Operation:writeName:ValidCPU
Value:
1
(PID) Process:(7192) Activator.exeKey:HKEY_CURRENT_USER\SOFTWARE\ProcessLasso
Operation:writeName:ea
Value:
1
(PID) Process:(7192) Activator.exeKey:HKEY_CURRENT_USER\SOFTWARE\ProcessLasso
Operation:writeName:LicensedTo
Value:
admin
(PID) Process:(7192) Activator.exeKey:HKEY_CURRENT_USER\SOFTWARE\ProcessLasso
Operation:writeName:ViewState
Value:
1D730E1730821BB3
(PID) Process:(7192) Activator.exeKey:HKEY_CURRENT_USER\SOFTWARE\ProcessLasso
Operation:writeName:CacheTag
Value:
3F2750A5F14B6820
(PID) Process:(7192) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ProcessLasso
Operation:writeName:EDD
Value:
1
(PID) Process:(7192) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ProcessLasso
Operation:writeName:ValidCPU
Value:
1
(PID) Process:(7192) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ProcessLasso
Operation:writeName:ea
Value:
1
(PID) Process:(7192) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ProcessLasso
Operation:writeName:LicensedTo
Value:
admin
Executable files
36
Suspicious files
176
Text files
25
Unknown types
2

Dropped files

PID
Process
Filename
Type
8152firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
8152firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
8152firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:C95DDC2B1A525D1A243E4C294DA2F326
SHA256:3A5919E086BFB31E36110CF636D2D5109EB51F2C410B107F126126AB25D67363
7192Activator.exeC:\Users\admin\Desktop\prolasso.keybinary
MD5:422411B13506374E17967CB5BDA59467
SHA256:ABAE0F95ABEBC2F3B10D6D4C103C7E17E0A5638E62AF56A259160E6008035A00
8152firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
8152firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
8152firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
8152firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
8152firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
8152firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:F249C74FDDA038E653160A774ED22718
SHA256:DC4627E9D083A0CC35697B93E2C6E80B0341BC34BA1B9D55DFE3053E65BE0BC9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
75
DNS requests
106
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7848
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8152
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
8152
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/s/wr3/3H4
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8152
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
8152
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
8152
firefox.exe
POST
—
142.250.185.163:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
8152
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
8152
firefox.exe
POST
200
184.24.77.54:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.130
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.0
  • 40.126.31.67
  • 40.126.31.130
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Activator.exe