URL:

https://github.com/Fndroid/clash_for_windows_pkg/releases/download/0.20.39/Clash.for.Windows.Setup.0.20.39.ia32.exe

Full analysis: https://app.any.run/tasks/abe631a9-bb1e-490f-af63-2075fd9b5eab
Verdict: Malicious activity
Analysis date: October 21, 2023, 19:46:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

098D8D2E0EF6510E6963B13FE41246ED4A0BB904

SHA256:

ECE22355FA61933673BA6BAEF063CDF0C45E6835B1E3F3B7EB961EAFA9BC4EDE

SSDEEP:

3:N8tEdHfF6WXSNMdkCVlEK8Lj8SZDMMA:2uiQpdZE5ZgB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • clash-win32.exe (PID: 3184)

    • Loads dropped or rewritten executable

      • Clash for Windows.exe (PID: 3580)
      • Clash for Windows.exe (PID: 3400)
      • Clash for Windows.exe (PID: 3064)
      • Clash for Windows.exe (PID: 2432)

    • Drops the executable file immediately after the start

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • Clash for Windows.exe (PID: 2432)
      • Clash for Windows.exe (PID: 3400)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 3416)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2696)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Starts application with an unusual extension

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • cmd.exe (PID: 3068)

    • Get information on the list of running processes

      • nsA449.tmp (PID: 1864)
      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • cmd.exe (PID: 2124)

    • Starts CMD.EXE for commands execution

      • nsA449.tmp (PID: 1864)
      • Clash for Windows.exe (PID: 3400)

    • Drops a system driver (possible attempt to evade defenses)

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Drops 7-zip archiver for unpacking

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Process drops legitimate windows executable

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Application launched itself

      • Clash for Windows.exe (PID: 2432)

    • Reads the Internet Settings

      • Clash for Windows.exe (PID: 2432)

    • Reads settings of System Certificates

      • Clash for Windows.exe (PID: 2432)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 3920)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 3068)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3416)

    • Powershell version downgrade attack

      • powershell.exe (PID: 2696)

  • INFO

    • Create files in a temporary directory

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • Clash for Windows.exe (PID: 2432)

    • Reads the computer name

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • Clash for Windows.exe (PID: 2432)
      • Clash for Windows.exe (PID: 3064)
      • Clash for Windows.exe (PID: 3580)
      • clash-win32.exe (PID: 3184)
      • Clash for Windows.exe (PID: 3400)

    • Application launched itself

      • iexplore.exe (PID: 556)

    • Loads dropped or rewritten executable

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Checks supported languages

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • nsA449.tmp (PID: 1864)
      • Clash for Windows.exe (PID: 2432)
      • Clash for Windows.exe (PID: 3580)
      • Clash for Windows.exe (PID: 3400)
      • Clash for Windows.exe (PID: 3064)
      • clash-win32.exe (PID: 3184)
      • chcp.com (PID: 2148)

    • The process uses the downloaded file

      • iexplore.exe (PID: 556)
      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3124)

    • Reads the machine GUID from the registry

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • Clash for Windows.exe (PID: 2432)

    • Creates files or folders in the user directory

      • Clash.for.Windows.Setup.0.20.39.ia32.exe (PID: 3528)
      • Clash for Windows.exe (PID: 3064)
      • Clash for Windows.exe (PID: 3400)
      • Clash for Windows.exe (PID: 2432)

    • Manual execution by a user

      • Clash for Windows.exe (PID: 2432)

    • Process checks computer location settings

      • Clash for Windows.exe (PID: 3400)
      • Clash for Windows.exe (PID: 2432)

    • Reads product name

      • Clash for Windows.exe (PID: 3400)

    • Reads Environment values

      • Clash for Windows.exe (PID: 3400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
20
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe clash.for.windows.setup.0.20.39.ia32.exe no specs nsa449.tmp no specs cmd.exe no specs tasklist.exe no specs find.exe no specs clash for windows.exe no specs clash for windows.exe no specs clash for windows.exe clash for windows.exe no specs searchprotocolhost.exe no specs clash-win32.exe no specs cmd.exe no specs route.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs cmd.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124tasklist /FI "USERNAME eq admin" /FI "IMAGENAME eq Clash for Windows.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
556"C:\Program Files\Internet Explorer\iexplore.exe" "https://github.com/Fndroid/clash_for_windows_pkg/releases/download/0.20.39/Clash.for.Windows.Setup.0.20.39.ia32.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
576route print 0.0.0.0 mask 0.0.0.0C:\Windows\System32\ROUTE.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\route.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1852netsh wlan show interfacesC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1864"C:\Users\admin\AppData\Local\Temp\nsu962F.tmp\nsA449.tmp" cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Clash for Windows.exe" | %SYSTEMROOT%\System32\find.exe "Clash for Windows.exe"C:\Users\admin\AppData\Local\Temp\nsu962F.tmp\nsA449.tmp—Clash.for.Windows.Setup.0.20.39.ia32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\nsu962f.tmp\nsa449.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2124cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Clash for Windows.exe" | %SYSTEMROOT%\System32\find.exe "Clash for Windows.exe"C:\Windows\System32\cmd.exe—nsA449.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
2148chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2432"C:\Users\admin\AppData\Local\Programs\Clash for Windows\Clash for Windows.exe" C:\Users\admin\AppData\Local\Programs\Clash for Windows\Clash for Windows.exe—explorer.exe
User:
admin
Company:
Fndroid
Integrity Level:
MEDIUM
Description:
Clash for Windows
Exit code:
0
Version:
0.20.39
Modules
Images
c:\users\admin\appdata\local\programs\clash for windows\clash for windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\clash for windows\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2696powershell.exe -ExecutionPolicy Bypass -Command "Get-NetFirewallRule -Description \"Work with Clash for Windows.\" | ? {$_.Enabled -eq \"True\"} | Get-NetFirewallApplicationFilter"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3064"C:\Users\admin\AppData\Local\Programs\Clash for Windows\Clash for Windows.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\clash_win" --mojo-platform-channel-handle=1292 --field-trial-handle=1040,i,5607249338811547983,18212606736386627263,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Programs\Clash for Windows\Clash for Windows.exe
Clash for Windows.exe
User:
admin
Company:
Fndroid
Integrity Level:
MEDIUM
Description:
Clash for Windows
Exit code:
0
Version:
0.20.39
Modules
Images
c:\users\admin\appdata\local\programs\clash for windows\clash for windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\uiautomationcore.dll
c:\users\admin\appdata\local\programs\clash for windows\ffmpeg.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
25 507
Read events
25 339
Write events
168
Delete events
0

Modification events

(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
50
Suspicious files
189
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
3124iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Clash.for.Windows.Setup.0.20.39.ia32.exe.hyvr4e0.partial —
MD5:—
SHA256:—
556iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Clash.for.Windows.Setup.0.20.39.ia32.exe —
MD5:—
SHA256:—
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:30EC550D43B27EFA5E4FA38FFD129F56
SHA256:1814421F2FD7D864BA3DEA979E1EF25DF1C0E4232222E31332D923E593A00527
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50CD3D75D026C82E2E718570BD6F44D0_D222662A57BAA60D2F5EA0D2CC7B2F1Cbinary
MD5:6B6DED5B91E4A69487941872369FDF58
SHA256:2F26F54362A12440ECF3D678EBBB4742627BBDD1B60E21C4C67414C8C8613E0C
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50CD3D75D026C82E2E718570BD6F44D0_D222662A57BAA60D2F5EA0D2CC7B2F1Cbinary
MD5:040133327C69193389F7029587FC6601
SHA256:2911C3BB66A373CC9C7B44719CEFBD8218019EBCF773F0CC6C7DED56151F1FD6
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:941C9D0D26C17414EF5E9C83C46A53C2
SHA256:54F45EB4F9A04DECBE30CDB1A03E02B4F2472E654BE7F03F7C44D42E17DAA791
3528Clash.for.Windows.Setup.0.20.39.ia32.exeC:\Users\admin\AppData\Local\Temp\nsu962F.tmp\app-32.7z —
MD5:—
SHA256:—
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:1419219A26F29C7FA5D95E2CC924D171
SHA256:1CBEEF068D17C4D4CAAA5B3D82B83DEC4E1F6FE699CB21CD504B12490E5EA2AC
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:57657EDA77E3E90059FD5CA4785F9433
SHA256:A0BF116DAE804DD4949473F40C081F024643437EF0C5C8D339199B2EE2EA5091
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
25
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
556
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
der
471 b
—
556
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
der
471 b
—
3124
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c0b0cfbec41be01e
unknown
compressed
4.66 Kb
—
3124
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f96a15a63697bdc6
unknown
compressed
4.66 Kb
—
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
—
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
—
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAzQqL7GMs%2FmReygqbCE%2Bxw%3D
unknown
binary
314 b
—
556
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
unknown
3124
iexplore.exe
140.82.121.3:443
—
GITHUB
US
unknown
4
System
192.168.100.255:137
—
—
—
unknown
3124
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
unknown
3124
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
3124
iexplore.exe
185.199.109.133:443
objects.githubusercontent.com
FASTLY
US
unknown
4
System
192.168.100.255:138
—
—
—
unknown
556
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
unknown
556
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
556
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.108.133
unknown
iecvlist.microsoft.com
  • 152.199.19.161
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
unknown
ieonline.microsoft.com
  • 204.79.197.200
unknown
go.microsoft.com
  • 23.35.238.131
unknown
www.msn.com
  • 204.79.197.203
unknown
redirector.gvt1.com
  • 172.217.16.206
unknown
r2---sn-q4flrn7k.gvt1.com
  • 209.85.165.71
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/Fndroid/clash_for_windows_pkg/releases/download/0.20.39/Clash.for.Windows.Setup.0.20.39.ia32.exe