File name:

Windows+Loader+BY+Eternity+狂熱.exe

Full analysis: https://app.any.run/tasks/1a6ab79a-648f-4642-8131-bd1906a31996
Verdict: Malicious activity
Analysis date: June 21, 2025, 02:26:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

394B21A2149C2520F48F854CC0B40E5F

SHA1:

561143645CE8CC03B9F006317074823D4C838CED

SHA256:

ED4487EF82F1BED6B41B7D4BCE51D70A4D92EE4BE22510A33089009E59A4537F

SSDEEP:

98304:Ef0KJvGpTwyx2W887PPDle3c7ISl73wgFDbhwp9Eig3C4z6ScESUKiuI9PG8Vvat:Jm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Opens a text file (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • Windows+Loader+BY+Eternity+狂熱.exe (PID: 2000)

    • Executable content was dropped or overwritten

      • Windows+Loader+BY+Eternity+狂熱.exe (PID: 2000)
      • Windows Loader.exe (PID: 1028)

    • Reads the BIOS version

      • Windows Loader.exe (PID: 1028)

    • Starts CMD.EXE for commands execution

      • Windows Loader.exe (PID: 1028)
      • cmd.exe (PID: 4044)
      • cmd.exe (PID: 2992)

    • Application launched itself

      • cmd.exe (PID: 4044)
      • cmd.exe (PID: 2992)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 3312)
      • cmd.exe (PID: 2336)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1884)
      • cmd.exe (PID: 1748)

    • The process executes VB scripts

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 2340)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • Changes charset (SCRIPT)

      • cscript.exe (PID: 4016)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • Reads data from a file (SCRIPT)

      • cscript.exe (PID: 4016)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • cscript.exe (PID: 4016)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • There is functionality for communication over UDP network (YARA)

      • Windows Loader.exe (PID: 1028)

    • Creates file in the systems drive root

      • Windows Loader.exe (PID: 1028)
      • cmd.exe (PID: 872)
      • bootsect.exe (PID: 1164)

    • There is functionality for taking screenshot (YARA)

      • Windows Loader.exe (PID: 1028)

    • Process drops legitimate windows executable

      • Windows Loader.exe (PID: 1028)

    • The system shut down or reboot

      • cmd.exe (PID: 3824)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1404)
      • sipnotify.exe (PID: 1524)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1524)

  • INFO

    • Checks supported languages

      • Windows+Loader+BY+Eternity+狂熱.exe (PID: 2000)
      • Windows Loader.exe (PID: 1028)
      • bootsect.exe (PID: 1164)
      • IMEKLMG.EXE (PID: 888)
      • IMEKLMG.EXE (PID: 1204)

    • Reads the computer name

      • Windows+Loader+BY+Eternity+狂熱.exe (PID: 2000)
      • Windows Loader.exe (PID: 1028)
      • IMEKLMG.EXE (PID: 1204)
      • IMEKLMG.EXE (PID: 888)

    • The sample compiled with english language support

      • Windows+Loader+BY+Eternity+狂熱.exe (PID: 2000)
      • Windows Loader.exe (PID: 1028)

    • Manual execution by a user

      • notepad.exe (PID: 2604)
      • Windows Loader.exe (PID: 1028)
      • Windows Loader.exe (PID: 3288)
      • IMEKLMG.EXE (PID: 1204)
      • IMEKLMG.EXE (PID: 888)
      • msedge.exe (PID: 2436)

    • Reads the machine GUID from the registry

      • Windows Loader.exe (PID: 1028)

    • Reads product name

      • Windows Loader.exe (PID: 1028)

    • Reads Environment values

      • Windows Loader.exe (PID: 1028)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 4016)
      • cscript.exe (PID: 2012)

    • UPX packer has been detected

      • Windows Loader.exe (PID: 1028)

    • Application launched itself

      • msedge.exe (PID: 2436)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 888)
      • IMEKLMG.EXE (PID: 1204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 449536
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.715
ProductVersionNumber: 1.2.0.715
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX
FileVersion: 1, 2, 0, 715
InternalName: 7zSfxNew
LegalCopyright: Copyright © 2005-2007 Oleg N. Scherbakov
LegalTrademarks: -
OriginalFileName: 7zSfxNew.exe
PrivateBuild: July 14, 2007
ProductName: 7ZSfxNew
ProductVersion: 1, 2, 0, 715
SpecialBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
49
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windows+loader+by+eternity+狂熱.exe notepad.exe no specs windows loader.exe no specs windows loader.exe cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs compact.exe no specs cmd.exe no specs bootsect.exe no specs cmd.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
872cmd.exe /A /C "C:\bootsect.exe /nt60 SYS /force" C:\Windows\System32\cmd.exe—Windows Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
888"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1028"C:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\Windows Loader\Windows Loader.exe" C:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\Windows Loader\Windows Loader.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\windows loader by eternity 狂熱\windows loader\windows loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1164C:\bootsect.exe /nt60 SYS /force C:\bootsect.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Sector Manipulation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\bootsect.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1204"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1236icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F) C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1404C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1524C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1568icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F) C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1576shutdown -r -t 0 C:\Windows\System32\shutdown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
Total events
6 017
Read events
5 966
Write events
44
Delete events
7

Modification events

(PID) Process:(1404) ctfmon.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:internat.exe
Value:
(PID) Process:(1204) IMEKLMG.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\IMEJP\14.0
Operation:writeName:SetPreload
Value:
1
(PID) Process:(888) IMEKLMG.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\IMEKR\14.0
Operation:writeName:SetPreload
Value:
1
(PID) Process:(2436) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2436) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2436) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2436) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2436) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2436) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2436) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
B5EECF04A2962F00
Executable files
10
Suspicious files
162
Text files
206
Unknown types
0

Dropped files

PID
Process
Filename
Type
1164bootsect.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
2000Windows+Loader+BY+Eternity+狂熱.exeC:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\Windows Loader\Keys.initext
MD5:E4D00F67799ECD5391509909DA36AE8A
SHA256:7CCB35334DF35B9CE6FB3191075689AA78698193980D7994B7C2C2061A3775A5
2000Windows+Loader+BY+Eternity+狂熱.exeC:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\Windows Loader\Windows Loader.exeexecutable
MD5:54687DFBD4E31C206EA4036FCAD32738
SHA256:FC761228D8892545E813E763DEAC19105C3FCE15EBD642F5332AD12217402CEB
2000Windows+Loader+BY+Eternity+狂熱.exeC:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\Windows Loader\checksums.md5text
MD5:891E8EA59ABDC2FC793F0F6A0D7FD21A
SHA256:8BA71764DF42BCBD566FA740CBB712B355556A42FB2FEB90040BB6BA48E3D32F
2000Windows+Loader+BY+Eternity+狂熱.exeC:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\說明.txttext
MD5:52E5E1659E410059BC81EB56A9C1114F
SHA256:C73D68D33F0293CE408F16DD51960F8925CFD50118DF616D2774677EE893957C
2000Windows+Loader+BY+Eternity+狂熱.exeC:\Users\admin\Desktop\Windows Loader BY Eternity 狂熱\ShedkoFolderico3_149299334.icoimage
MD5:48FA8FB0859F631CAF02828B8E5AB6B2
SHA256:BEED9AF4B94624FE5A750EF5B0631F1471E7BEC758F6CDD958EC5470787110A9
1524sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\main.jpgimage
MD5:C8BCC2041232DA45C1367F1FEED51370
SHA256:C0EC6771F923E7B85F6E2E7AA58D6BA51D322E78F53CEE8108DBBFD352BE7B25
2460msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma~RF8b09.TMPbinary
MD5:C612E96CBFAC63232FC2062E15600FB1
SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF
1524sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\default.cabcompressed
MD5:340674F6A3D1562E28A011EC11E40D83
SHA256:259880E2346D986ABEED46AA9C2917C53E969AAE6927F2CA0A2AD0967736DF98
2436msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:C71FF4D3A6085C165C6A9C908C072A09
SHA256:3CA7B7E98B5CA1C1DC458415463D00ACD9DF8302F481B103C93177FD2642B37B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
69
DNS requests
88
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1524
sipnotify.exe
HEAD
503
104.102.43.250:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133949500878430000
unknown
—
—
whitelisted
2624
msedge.exe
GET
200
104.18.38.233:80
http://crt.sectigo.com/SectigoPublicServerAuthenticationRootR46.p7c
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1524
sipnotify.exe
104.102.43.250:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
whitelisted
1112
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2624
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2436
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
2624
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2624
msedge.exe
104.21.16.1:443
blog.yam.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
query.prod.cms.rt.microsoft.com
  • 104.102.43.250
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
blog.yam.com
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.48.1
whitelisted
www.yam.com
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.48.1
  • 104.21.16.1
whitelisted
cdnjs.cloudflare.com
  • 104.17.24.14
  • 104.17.25.14
whitelisted
code.jquery.com
  • 151.101.66.137
  • 151.101.130.137
  • 151.101.194.137
  • 151.101.2.137
whitelisted
cdn.jsdelivr.net
  • 151.101.193.229
  • 151.101.1.229
  • 151.101.129.229
  • 151.101.65.229
whitelisted
weather.yam.com
  • 52.187.123.178
whitelisted

Threats

PID
Process
Class
Message
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2624
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2624
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2624
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows+Loader+BY+Eternity+狂熱.exe